Attacking JSON - Vulnerabilities in Popular Parsers

Offered By: OWASP Foundation via YouTube

Course Description

Overview

Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only!

Explore the security vulnerabilities in JSON parsers and other serialization formats in this 41-minute conference talk from AppSecUSA 2017. Delve into the aftermath of the 2016 Java deserialization apocalypse and examine why JSON, often recommended as a safer alternative, may still be susceptible to Remote Code Execution (RCE) attacks. Analyze popular JSON parsers in both .NET and Java, identifying potential RCE vectors and vulnerable configurations. Expand your understanding to other serialization formats, with a particular focus on .NET. Discover new vulnerable formats and learn about stable RCE gadgets in system libraries. Gain valuable insights on assessing code vulnerability, implementing remediation strategies, and exploring alternative approaches to enhance security in serialization processes.

Syllabus

Friday the 13th: Attacking JSON - Alvaro Muñoz & Oleksandr Mirosh - AppSecUSA 2017

Taught by

OWASP Foundation

Related Courses

Hardening Java's Access Control by Abolishing Implicit Privilege Elevation
IEEE via YouTube BaRMIe - Poking Java’s Back Door
44CON Information Security Conference via YouTube Penetration Testing Considered Harmful
44CON Information Security Conference via YouTube New Exploit Technique in Java Deserialization Attack
Black Hat via YouTube An In-Depth Study of More Than Ten Years of Java Exploitation
Association for Computing Machinery (ACM) via YouTube