serialization

Java Serialisation – the gift that keeps on taking (Part 3)

| | Cybersecurity, deserialization, Java, serialization
In the previous post we  examine particular Java Serialisation characteristics and design points that had a few unexpected consequences.  In this post we'll explore more around exploiting serialisation datastreams.  How it's possible to ...
Sonatype Blog

Java Serialisation – the gift that keeps on taking, Part 2.

| | DevZone, Java, Open Source Security, serialization
Unexpected Consequences   ...
Sonatype Blog

Java Serialization. The gift that keeps on taking. Part 1

| | DevZone, Java, Log4j, serialization
Hands up who has heard of Log4Shell?  No? If you’re a Java developer and this term isn’t familiar to you then you might want to google it right now. We’ll wait ...
Sonatype Blog
serialization

Serialization: Protecting Enterprise Critical Applications

| | Data Security, deserialization, marshaling, memory, Oracle WebLogic, Ransomware, serialization, unmarshaling
Enterprise organizations have built much of their foundations on Oracle’s WebLogic servers. As ubiquitous as they are, it’s no wonder that they are often the target of sophisticated attacks aimed at harvesting ...
Security Boulevard
Understanding ysoserial's CommonsCollections1 exploit

Understanding ysoserial’s CommonsCollections1 exploit

| | CommonsCollections1, deserialization, Java, serialization, ysoserial
Last year, ysoserial was released by frohoff and gebl. It is a fantastic piece of work. The tool provides options to generate several different types of serialized objects, which when deserialized, can result ...
Random Security