Insecure Deserialization

Insecure deserialization vulnerabilities happen when application deserialize program objects without proper precaution. An attacker can then manipulate serialized objects to change the program's behavior. Insecure deserialization vulnerabilities are hard to find and exploit, but they can lead to RCE's which are very strong.

Hunt for Insecure Deserialization

1. If you can get access to an application's source code, search for deserialization functions in source code that accept user input.
2. If you cannot get access to source code, look for large blobs of data passed into an applicaiton. These could indicate serialized objects that are encoded.
3. Alternatively, look for features that might have to deserialize objects supplied by the user, such as database inputs, authentication tokens, and HTML form parameters.
4. If the serialized object contains information about the identity of the user, try tampering with the serialized object found and see if you can achieve authentication bypass.
5. See if you can escalate the flaw into a SQL injection or remote code execution. Be extra careful not to cause damage to your target application or server.