Insecure Deserialization Attack Explained

#Deserialization #WebSecurity

We'll explore the basic concepts of an Insecure Deserialization by attacking a web app written in Python.

🎵 Track: Warriyo - Mortals (feat. Laura Brehm)

[frmage]

Amazing video! It would be great if you could also include a small section at the end on how to defend against these vulnerabilities for the blue team people out there :D

[batatakhizou]

One of the best tutorials channel out there, MADE RESPECT TO YOU

[marlon]

Your timing with these videos is pretty good! When I finished a challenge about Server-Side Template Injections you uploaded the video about SSTIs. And today I finished a challenge about Deserialization Attacks and now you uploaded this! Haha, keep it going man :)

[RnVjayBZbVdWJl]

I found your channel earlier today when trying to search for anyone explaining the difference between XSS in HTML and XSS in json requests. Haven't had the luck but saw your XSS video. Loved it a lot and shared it with my co-workers! Trying to advance myself in web application pentesting and understand everything. It's rare to see people explain in a good way and even get things drawn graphically in front of you. It helps a lot so thank you!

I've been working with this for about a year from being freshly new from university. All you learn is mostly the theoretical part and not the practical. What i've recently noticed is that i lack the knowledge in HTML to be able to perform and really understand XSSes. So i have also been on the look out to create a web application and use some HTML to really understand JavaScript.

p.s Just got myself two 1TB M2 SSD for my Raspian :P Already have pi-hole installed and will now fiddle with creating an OpenMediaVault to create my own NAS. Hoping by fiddling with stuff like this, will give me more knowledge in actual hacking and understanding it all. Will be fun! Love your videos! have only seen two of them. Saving the rest for the weekend. Good job with them all and greetings from Sweden! :P

[alexandros]

The gif of the person banging his head against the desk accurately sums up my pentesting career… love all your content btw

[prog_demos]

You're doing an amazing job. I have no idea why you don't have like 2 mil subs. I'm sure that in like a year or two we'll be there as well.

Greetings from a fellow Gen Z-er from Croatia

[eccentricOrange]

1:04 I love how you took a moment there and then actually estimate "5 hours or so" as though it was meant to be precise :D

[Omar-wmkz]

the only teachers which i like Pwn for these awesome videos and net-ninja for explainning java script and web technologies.

[_xylotus_]

Keep going man, pretty underrated channel. I bet it'll gain some more popuation over time. The video has good quality.

[thesmartguy]

Quality content like this is what is needed more. Kudos to you mate - waiting for more.

[telnobynoyator_]

came for the penguin profile pic, stayed for the awesome content

[rishabhtiwari]

Just imagine if this guy creates his own course. That would be crazy.

[vxqr]

I have nothing to add, but to support this channel I will leave a comment.

[khanhhnahk]

Thank you so much for your explaination, cant find anywhere else better than yours, hope you can make a lot more videos related to web vulnerabilities :D

[ratulhasan]

Quick question: how did python code run in the server? Is it converted to ASM or some global language?

[avilde]

Well done with ilustrations and quite a good explanation. Definetely would be useful to also hear how to defend against such attacks )

[Vazzible_gaming]

I have a good idea for you, might I suggest you try giving us some QNA notes or questions at the beginning of each video, giving us the necessary question, and then you go onto answer the questions in depth in the rest of the video.

[malikashtar]

Channels underrated but only one request would like mic volume to increase!!! 😍

[saladking]

Love your content, man! I'm curious about what you use to draw on screen? What software & hardware do you use for drawing?

[janwrona]

Great explanation of what de/serialization is !