All right.
Let's talk about insecurity serialization in this topic is kind of hard to wrap your mind around as
to how it works because there's so many different ways that this could work.
And unfortunately we're going to have to talk at a high level because there's not really a good application
out there that we can utilize and we can't utilize our application for this attack.
So this insecure D serialization we have to talk about what serialization is and what D serialization
is.
All right.
So when we talk about serialization that is taking this data and we're going to convert an object into
this format which can be put onto a disk right.
And it can be sent over to a network or through a network so it can be serialized in a lot of different
things.
It could be serialized in Excel.
Jason Gamble can be serialized in binary and it is you know it's serialized and it's sent over the opposite
process of that is called D serialization.
So that means we're taking this serialized data and then we're d serialized it.
Right.
So once we get it we we d serialize it.
So the process of a insecure D serialization attack is when we have something malicious we take something
malicious we have an exploit we serialize that exploit and then the application takes that data and
it deals serialize is it and executes it.
OK.
And why does this happen why does this work.
Well web apps are always using shouldn't they always they they use quite a bit serialization in D serialization
right.
So this is happening all the time.
This is why this makes the top 10 is because we can utilize this kind of attack so we can send it something
serialize and then it's going to take it and it's going to d serialize it and run it and execute it.
Now these are kind of hard to find and there are so many different executable is out there and attacks
and different programming languages that this goes to and software libraries et cetera that this makes
it really really difficult to just go out there and find it but it doesn't mean that they're not out
there.
OK.
So I definitely encourage you to read up on this.
There's all kinds of cheap cheats on how to look for this and scan for this and really it comes down
a lot to known vulnerabilities.
And this is how to prevent it.
It says here you know that you shouldn't accept serialized objects from untrusted sources.
That's true.
That's the best case scenario when we talk about prevention.
If the source is untrusted you shouldn't accept anything right because then we're going to send it a
serialized object.
The application is going to take a d serialize it and it's going to execute that code.
And we don't want that to happen as a developer.
OK.
So I encourage you again to read up on this.
It is a complicated topic.
It is by far not easy.
And when you're talking about an interview process which is what we're after again here right.
You should just know the serialization in D serialization process what it's using.
And then there is a tool that you can read up on that people use quite a bit in it's called Why.
So serial so read up on why so serial and what it does and how to kind of utilize it if you know that
tool you know serialization is what civilization is and what these serialization is.
I think you'll be fine in an interview.
This one is kinda it's something you're not going to come across a lot but it still belongs in the top
ten just for how you know how deadly I guess it can be.
So that's it for this one.
We're going to move on to number nine which is using components with known vulnerabilities and then
we're going to talk about insufficient logging monitoring and in episode 10 or our topic 10 and then
we're going to be done with the web app section.
So I'll catch you over in the next video and we start talking about using components with known vulnerabilities.