Hands-On Application Penetration Testing with Burp Suite

Detecting insecure deserialization

Deserialization is the process of passing some type of data to other data, to be managed by the application, for example, passing a JSON format request that is parsed and managed as XML by the application. Also, there are deserialization vulnerabilities where the technology used in the development is involved. These vulnerabilities pass resources of a certain type to binary objects.

To understand the vulnerability, review the next snippet of code, published in the CVE.2011-2092:

[RemoteClass(alias="javax.swing.JFrame")] 
public class JFrame { 
   public var title:String = "Gotcha!"; 
   public var defaultCloseOperation:int = 3; 
   public var visible:Boolean = true; 
} 

This code is the class definition of a data type ...