Writing on web security

Node.js deserialization bugs strike when a serializer revives function bodies from text and runs them on load. See the trick and why…

Ruby yaml deserialization lets the default Psych loader build arbitrary objects from YAML tags. See why safe_load matters and how to stop…

Ruby marshal deserialization rebuilds arbitrary objects when Marshal.load runs on untrusted bytes, a trigger for a gadget chain. See the fix.

Phar deserialization fires object injection when a file function touches a phar path, with no unserialize() in sight. See the trigger and…

PHP object injection turns unserialize() on user data into live objects whose magic methods fire a POP chain. See how it works…

PyYAML deserialization with the default loader builds objects from tags and runs code on load. See how yaml.load differs from yaml.safe_load.

Python pickle deserialization runs code on load. See how the __reduce__ protocol turns a crafted pickle into a command, and what to…

TypeNameHandling in Json.NET embeds a type field that picks the class to build. See how All and Auto enable a gadget and…

BinaryFormatter deserialization rebuilds arbitrary .NET object graphs from untrusted bytes and fires callbacks that reach gadgets. See why it is unsafe.

ViewState deserialization rebuilds page state from a hidden field. See how a disabled MAC or leaked machine key lets an attacker forge…