DEF CON 25 Conference - Alvaro Muñoz, Alexandr Mirosh - Friday the 13th JSON attacks
Автор: DEFCONConference
Загружено: 2017-11-02
Просмотров: 5573
2016 was the year of Java deserialization apocalypse. Although Java Deserialization attacks were known for years, the publication of the Apache Commons Collection Remote Code Execution (RCE from now on) gadget finally brought this forgotten vulnerability to the spotlight and motivated the community to start finding and fixing these issues.
One of the most suggested solutions for avoiding Java deserialization issues was to move away from Java Deserialization altogether and use safer formats such as JSON. In this talk, we will analyze the most popular JSON parsers in both .NET and Java for potential RCE vectors.
We will demonstrate that RCE is also possible in these libraries and present details about the ones that are vulnerable to RCE by default. We will also discuss common configurations that make other libraries vulnerable.
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
