Главная
Study mode:
on
1
Introduction
2
Demo
3
Visualizing the serialized process
4
Autotype support
5
Autotype bypass
6
Magic Method
7
Derivation
8
JSONpath
9
Gen
10
Tron
11
ReadWrite
12
LevelDB
13
Red File
14
Read Files
15
Post Penetration
Description:
Explore a Black Hat conference talk that delves into exploiting a JSON deserialization vulnerability in Fastjson, a popular open-source JSON parser. Learn how the speakers bypassed security checks and mitigations by leveraging inheritance processes of basic classes to achieve remote code execution. Discover the step-by-step process, from introduction and demo to visualizing the serialized process, autotype support and bypass, magic method derivation, JSONpath, GenTron, and ReadWriteLevelDB. Gain insights into post-penetration techniques and understand the potential impact on blockchain security and financial transactions.

How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain

Black Hat
Add to list
0:00 / 0:00