Deserialization Attacks
forms #loginForms #registrationForms #privilegeEscalation Imagine an application with a form that sends a ping to some site, as the Cereal machine does. We’d intercept this request with burpsuite. We’re going to launch our localhost ip imagine it sends a payload like this obj=O%3A8%3A%22pingTest%22%3A1%3A%7Bs%3A9%3A%22ipAddress%22%3Bs%3A13%3A%22192.168.1.211%22%3B%7D&ip=192.168.1. At first this is urlencoded but if we select it and press […]