The newest Insecure Deserialization resources are on the Insecure Deserialization page. For a reading order instead of a date order, see the Insecure Deserialization learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2020-06-29 2020 | Insecure deserialization | Web Security Academy beginner 5 min read | Reference on insecure deserialization detailing its nature, common scenarios, and exploitation techniques across PHP, Ruby, and Java. It covers how user-controllable data manipulation during deserialization can lead to severe attacks, including object injection, privilege escalation, and remote code execution, while emphasizing the difficulty of secure deserialization and advocating for avoidance or strict pre-deserialization integrity checks. → portswigger.net |