Download to read offline
![[Wroclaw #7] Why So Serial?](https://cdn.slidesharecdn.com/ss_thumbnails/whysoserialv1-171206133328-thumbnail.jpg?width=640&height=640&fit=bounds)
Deserialization with the JavaScript for the lulz
- 1. DESERIALIZATION WITH THEJS FOR THE LULZ ANDREW FREEBORN
- 2.
- 3. BACKGROUND - SUB-AGENDA ▸Whywould you care? ▸Where is this an issue? ▸Surely there are tools to detect issues, right?
- 4. TELL ME THE“SO, WHAT” FACTOR, OR HOWEVER THAT SAYING GOES ▸The hot new vulnerability everyone has talking about since 2015 ▸Forshaw talked about in 2012, but may have been an issue for longer, but my Google didn’t say
- 5. MARSHALING? PICKLES? Justin: Thisis from Rick and Morty
- 6. TOMATO, TOMATOE ▸ Marshalling,Serialization, etc. are the same ▸ Example: Take an object like an integer, package it up to stream somewhere (like across the internet), and take it out of the package on the receiving end ▸ Terrible example, even Gordon hates it, and the meme isn’t relevant
- 7. BINARY, 1S AND0S ▸ https://www.geeksforgeeks.org/serialization-in-java/
- 8. THIS IS WHERETHE FUN BEGINS
- 9. VERY TECHNICAL PROCESSDIAGRAM
- 10. BUT WHY ▸ Sometimes,programs want to be helpful ▸ The other side interprets the type of object that it received and may not be doing any type checking ▸ If the distant end gets an XML object, it’s going to call a constructor to make an XML object ▸ If the distant end gets a request to make a “shell”, it may have access to the libraries to do so and make one
- 11. THIS IS ONLYA JAVA PROBLEM BECAUSE MICROSOFT, RIGHT? (LULZ) ▸ Its a problem with any language that doesn’t automatically enforce strong typing ▸ Python, .Net, Java, Ruby, JavaScript, probably Perl as well but no one uses it ▸ Super easy to miss and requires more awareness ▸ It’s a real thing now in the OWASP Top 10!
- 12. OWASP TOP TEN2017 ▸ https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
- 13. EVERYONE IS TALKINGABOUT IT ▸ “Started” with Marshalling Pickles by @frohoff and @gebl ▸ Alvaro Munoz messed with Java Deserialization ▸ Apache Commons Collection was a free-for-all (FoxGlove has a great paper on this) ▸ James Forshaw, Alvaro Munoz talked about the .Net side ▸ More people are talking about this problem
- 14. ARE YOU AFRAIDOF THE DARK…. OR DESERIALIZATION? ▸ Your apps may be using serialization techniques without you knowing it ▸ Do you create and write files? ▸ Do you transmit things over a network? ▸ Do you even lift bro? ▸ Do you allow user defined input that could be a JSON object and use that?
- 15. TOOLS CAN SOLVETHIS, RIGHT? ▸ Kinda, but if they did, these problems would already be fixed, right? ▸ There’s: ▸ Burp has plugins to investigate serialization ▸ Linters and tools like ysoserial, ysoserial.net ▸ Static / Dynamic assessment tools ▸ Postman, VSCode ▸ There’s one tool that’s better than all of those
- 16. REBECCA BLACK BELIEVESIN YOU, AND SO DO I ▸ You in your environment is the best tool ▸ I couldn’t find a good enough pic of Taylor Swift pointing
- 17. SHOW ME SOMETOOLS ▸ I checked out a few tools to see what I could find ▸ SWAMP
- 18. TOOLS ▸snyk.io ▸Didn’t identify theintentional deserialization vulnerability with the free version ▸Node Security Project may be better? BitHound.io had issues
- 19. ALMOST DEMO TIME ▸Remember when I said the best tool is you? Well you are, with knowledge of what to look for ▸ The issue is very different in each instance ▸ Alvaro exploited JSON in .Net ▸ @frohoff exploited pickling in Python ▸ Breen exploited Java and Apache ▸ Forshaw exploited XML and broken Microsoft… I mean BinaryFormatter ▸ I’m going to show something in JavaScript
- 20. JUST PLEASE DEMONOW, KTHXBAI ▸ OWASP Juice Shop will be the target ▸ JavaScript, the latest hotness ▸ NPM, Express, Angular, Rectangular, Octagon ▸ Bjorn recently added deserialization challenges ▸ Not a live demo today ▸ The screenshots are big though!
- 21.
- 22.
- 23. DEMO: OWASP JUICESHOP ▸ The tools should have picked up a few of these challenges
- 24. DEMO: OWASP JUICESHOP - 1 STAR CHALLENGES
- 25. DEMO: OWASP JUICESHOP - 5 STAR CHALLENGES
- 26. DEMO: OWASP JUICESHOP - PWNING JUICE SHOP ▸ https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/part2/deserialization.html
- 27. DEMO: OWASP JUICESHOP - ZOOMING AHEAD
- 28. DEMO: OWASP JUICESHOP - ZOOMING AHEAD
- 29. DEMO: OWASP JUICESHOP - ZOOMING AHEAD
- 30. DEMO: OWASP JUICESHOP - DEV TOOLS ARE AWESOME ▸ A lot of challenges can be solved with the Dev Tools
- 31. DEMO: OWASP JUICESHOP - DEV TOOLS | NETWORK
- 32. DEMO: OWASP JUICESHOP - HEADERS
- 33. DEMO: OWASP JUICESHOP - AUTH TOKENS
- 34. DEMO: OWASP JUICESHOP - PAYLOAD AND CURL EXAMPLE
- 35. DEMO: OWASP JUICESHOP - CURL IN TERMINAL IS PRETTY… SAD ▸ Sending a payload with curl interacting with the API
- 36. DEMO: OWASP JUICESHOP - USING POSTMAN IS SO 2018
- 37. DEMO: OWASP JUICESHOP - POSTMAN: USING APIS THE RIGHT WAY
- 38. DEMO: OWASP JUICESHOP - LET’S SEND A NASTY GRAM
- 39. DEMO: OWASP JUICESHOP - SOLVED THE CHALLENGE, HOW BOW DAH
- 40. DEMO: OWASP JUICESHOP - RUN MY JAVASCRIPT BRO ▸ The stack trace from the exception handler
- 41. DEMO: OWASP JUICESHOP - I SEE WHAT YOU DID THERE ▸ What’s this guy do
- 42. DEMO: OWASP JUICESHOP - B2BORDER.JS <INSERT BACKSTREET BOYS JOKE>
- 43. WHATS EVEN GOINGON ▸ Despite all of the cereal, serialization, deserialization, we as testers need to know as well as possible our apps ▸ Start with understanding the technologies used at work ▸ Play with intentionally vulnerable apps that somewhat resemble your environment ▸ Try to exploit the test apps as much as possible and see if you can find unintentional bugs, or add to the project to make new broken things ▸ In Juice Shop, you can change “vm” to “vm2” which is broken, or use “eval” instead of “not-evil” or “safeEval” ▸ Review closed issues to see what was broken and why
- 44. THANKS! ▸ Slacks tojoin: ▸ OmaSec: https://omasec.herokuapp.com ▸ DEFCON402: Email adam@dc402.org ▸ OWASP: https://owasp.herokuapp.com ▸ More web app hackery: ▸ https://vivirytech.blogspot.com