Insecure Deserialization For Beginners

Thank you for watching the video :
Insecure Deserialization For Beginners

Insecure deserialization is when user-controllable data is deserialized by a website. This potentially enables an attacker to manipulate serialized objects in order to pass harmful data into the application code. Currently it occupies the 8th spot in the #OWASPTo10 2021 list. It occurs when untrusted data is used to abuse the logic of an application, inflict a denial of service (DoS) attack, or execute arbitrary code when it is deserialized.

In this video we will learn what are magic methods, how to find deserialization vulnerability and how to exploit.

​

00:45 What is deserialization
02:20 Insecure deserialization
04:16 Serialized Object Format
05:40 Magic Methods
08:18 Spot a vulnerability
11:00 Sample code
12:30 Exploit Code
13:10 Demo

ABOUT OUR CHANNEL📜
Cyber Security is a non-profit initiative taken by security professionals. Here we are uploading a series of videos to learn and get expertise in various domains of security. We are teaching tools, techniques, and methods which can be used on penetration testing assignments.

📌CHECK OUT OUR OTHER VIDEOS
▶️How to Bypass WAF | Part 2
▶️Exploit Server Side Template Injection
▶️XPath Injection | XML Vulnerability for Beginners
▶️Authentication Bypass in PHP | PHP Type Juggling

FOLLOW US ON SOCIAL
▶️Security Blog
▶️Facebook

#owasptop10 #webapppentest #appsec #applicationsecurity #apitesting #apipentest #cybersecurityonlinetraining #freesecuritytraining #penetrationtest #ethicalhacking #burpsuite #pentestforbegineers #insecuredeserialization #php #magicmethods #unserialize

Related Searches:
insecure deserialization prevention
insecure deserialization attack
insecure deserialization medium
steps to avoid insecure deserialization
how to find deserialization vulnerability

[macktheripper]

This was just perfect dude thank you. I really appreciate your pace and explanation. My only question is can you just use gcc to create a payload and then replace the serialised cookie string ?

[whyzakee]

Please make a video for out-of-bound sql injection

[Manojkumar__]

Please Start Android pentesting Series