Automated Discovery of Deserialization Gadget Chains

Automated Discovery of Deserialization Gadget Chains

Explore automated discovery techniques for deserialization gadget chains in this Black Hat conference talk. Delve into the persistent threat of unsafe deserialization vulnerabilities and their impact on Java applications. Learn about magic methods, payload examples, and vulnerable libraries. Examine existing tools and discover a new approach for finding gadget chains through class/method hierarchy enumeration, passthrough dataflow discovery, and callgraph analysis. Investigate the results of open-source library scans, including newly discovered gadget chains in Clojure and Scala. Gain insights into potential improvements and future directions for automated discovery in this emerging field of cybersecurity research.