Java Deserialization Cheat Sheet – Detecting And Exploiting Vulnerabilities

A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries.

Please, use #javadeser hash tag for tweets.

Table Of Content

Java Native Serialization (binary)
- Overview
- Main talks & presentations & docs
- Payload generators
- Exploits
- Detect
- Vulnerable apps (without public sploits/need more info)
- Protection
- For Android
XMLEncoder (XML)
XStream (XML/JSON/various)
Kryo (binary)
Hessian/Burlap (binary/XML)
Castor (XML)
json-io (JSON)
Jackson (JSON)
Fastjson (JSON)
Genson (JSON)
Flexjson (JSON)
Jodd (JSON)
Red5 IO AMF (AMF)
Apache Flex BlazeDS (AMF)
Flamingo AMF (AMF)
GraniteDS (AMF)
WebORB for Java (AMF)
SnakeYAML (YAML)
jYAML (YAML)
YamlBeans (YAML)
“Safe” deserialization

Java Native Serialization (Binary)

Overview

Java Deserialization Security FAQ
From Foxgloves Security

Main talks & presentations & docs

Marshalling Pickles

by @frohoff & @gebl

Video
Slides
Other stuff

Exploiting Deserialization Vulnerabilities in Java

by @matthias_kaiser

Video

Serial Killer: Silently Pwning Your Java Endpoints

by @pwntester & @cschneider4711

Slides
White Paper
Bypass Gadget Collection

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.