Finding Java deserialization gadgets with CodeQL
Key | Action |
---|---|
K or space | Play / Pause |
M | Mute / Unmute |
C | Select next subtitles |
A | Select next audio track |
V | Show slide in full page or toggle automatic source change |
left arrow | Seek 5s backward |
right arrow | Seek 5s forward |
shift + left arrow or J | Seek 10s backward |
shift + right arrow or L | Seek 10s forward |
control + left arrow | Seek 60s backward |
control + right arrow | Seek 60s forward |
shift + down arrow | Decrease volume |
shift + up arrow | Increase volume |
shift + comma | Decrease playback rate |
shift + dot or shift + semicolon | Increase playback rate |
end | Seek to end |
beginning | Seek to beginning |
Share this media
HLS video stream
You can use an external player to play this stream (like VLC).
HLS video streamInformation on this media
Links:
Number of views:
55 (this month: 1)Creation date:
July 6, 2022Speakers:
Hugo VincentLicense:
CC BY-SA v4Description
Arbitrary object deserialisation vulnerability in Java applications can be really dangerous, but also worthless if you are not able to find a gadget chain. Some gadgets chains are known and can be used without much consideration, but most of them don't work anymore. Indeed, most known gadgets are 3 or 5 year olds. This can be explained by the fact that finding such chains is hard and few tools exist to automate this process. In this talk I want to present a new technique to easily find new gadgets by leveraging the power of CodeQL. CodeQL is a very powerful static code analyzer that provides a way to analyze code by querying it like a data store. It's open source and can work on open source projects as it requires the source code of the analysed application. CodeQL can find paths between different methods and calls inside an application. This is really useful for gadget chain as we need to look for code paths from a deserialization method to a dangerous one which can lead to arbitrary code execution.
I'm a pentester at Synacktiv
Other media in the channel "2022"
19 views, 1 this monthClosingJuly 6th, 2022
45 views, 1 this monthkdigger: A Context Discovery Tool for Kubernetes Penetration TestingJuly 6th, 2022
38 views, 1 this monthDissecting NTLM EPA & building a MitM proxyJuly 6th, 2022
74 views, 2 this monthMobSF for penetration testersJuly 6th, 2022
72 views, 1 this monthImprove your Malware Recipes with CyberchefJuly 6th, 2022
249 views, 15 this monthTAPIR : Trustable Artifact Parser for Incident ResponseJuly 6th, 2022