Java Deserialization Vulnerabilities - The Forgotten Bug Class

No ratings

Presented at Deepsec 2016 by

Matthias Kaiser

Java deserialization vulnerabilities are a bug class of its own. Although several security researchers have published details in the past, still the bug class is fairly unknown. This talk is about finding and exploiting deserialization flaws in Java. Several vulnerabilities and gadgets discovered by Code White will be shown as case studies including a new 0day.