corpus.blog
42,390 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0d36e-6d65-70e5-b023-d29b1ad81918

Serialization - A Hidden Threat

klezvirus.github.io · published 31 July 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at klezvirus.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
33
Words captured
28,061

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://github.com/klezVirus/klezVirus.github.io/tree/master/The_Big_Problem_of_Serialisation
github.com
https://docs.oracle.com/javase/8/docs/technotes/guides/reflection/proxy.html
docs.oracle.com
https://github.com/frohoff/ysoserial
github.com
https://github.com/klezVirus/klezVirus.github.io/tree/master/The_Big_Problem_of_Serialisation/java/Serialize
github.com
https://github.com/no-sec-marko/marshalsec/blob/master/marshalsec.pdf
github.com
https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-1-kryo-serialization
contrastsecurity.com
https://www.pwntester.com/blog/2013/12/23/rce-via-xstream-object-deserialization38/
pwntester.com
https://codewhitesec.blogspot.ru/2017/04/amf.html
codewhitesec.blogspot.ru
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
github.com
https://github.com/NickstaDB/DeserLab
github.com
https://github.com/NickstaDB/SerializationDumper
github.com
https://github.com/NickstaDB/SerialBrute
github.com
https://github.com/NickstaDB/BaRMIe
github.com
https://www.cognitous.co.uk/
cognitous.co.uk
https://github.com/pwntester/ysoserial.net/
github.com
https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf
blackhat.com
https://github.com/ambionics/phpggc
github.com
https://www.exploit-db.com/docs/47655
exploit-db.com
https://github.com/klezVirus/deser-py
github.com
https://github.com/klezVirus/deser-node
github.com
Ruby 2.x Universal RCE Deserialization Gadget Chain - elttam Read at the source ↗
elttam.com
https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Insecure%20Deserialization/Ruby.md
github.com
https://staaldraad.github.io/post/2019-03-02-universal-rce-ruby-yaml-load/
staaldraad.github.io
https://github.com/klezVirus/deser-ruby
github.com
https://www.exploit-db.com/docs/english/44756-deserialization-vulnerability.pdf
exploit-db.com
https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2017/june/ncc_group_combating_java_deserialization_vulnerabilities_with_look-ahead_object_input_streams1.pdf
nccgroup.trust
https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
github.com
https://stackoverflow.com/questions/3052202/how-to-analyse-contents-of-binary-serialization-stream
stackoverflow.com
https://media.blackhat.com/bh-us-12/Briefings/Forshaw/BH_US_12_Forshaw_Are_You_My_Type_WP.pdf
media.blackhat.com
https://www.php.net/manual/en/language.oop5.magic.php
php.net
https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
owasp.org
https://versprite.com/blog/application-security/into-the-jar-jsonpickle-exploitation/
versprite.com
https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
opsecx.com
Elsewhere on klezvirus.github.io (4)