Friday the 13th - JSON Attacks

Explore the critical security implications of JSON attacks in this 43-minute Black Hat conference talk. Delve into the aftermath of the 2016 Java deserialization apocalypse and its impact on vulnerability awareness. Learn about various JSON attacks, data libraries, and their classifications. Examine specific libraries like Jason, JavaScriptserializer, and JSONserializer through practical examples and demonstrations. Understand the differences between JSON serializers and parsers, and witness a live demonstration of an XML payload attack on a victim server. Gain valuable insights into this often overlooked security concern and be prepared to address questions on the topic.

Introduction
Agenda
JSON Attacks
Data Libraries
Requirements
Classification
List of libraries
Jason
JavaScriptserializer
JSONserializer
Example
Shoutout
Dotnet
Demo
Not a problem in Jason
Serializers
JSON parsers
Demonstration
XML payload
Victim server
Summary
Questions