FixTypo - Fix typo in various lesson documentations
This commit is contained in:
committed by
Àngel Ollé Blázquez
parent
de3c2c8d85
commit
f5e4d4717a
@ -1,5 +1,5 @@
|
||||
== What is a Gadgets Chain
|
||||
|
||||
It is weird (but it could happen) to find a gadget that runs dangerous actions itself when is deserialized. However, it is much easier to find a gadget that runs action on other gadget when it is deserializaded, and that second gadget runs more actions on a third gadget, and so on until a real dangerous action is triggered. That set of gadgets that can be used in a deserialization process to achieve dangerous actions is called "Gadget Chain".
|
||||
It is weird (but it could happen) to find a gadget that runs dangerous actions itself when is deserialized. However, it is much easier to find a gadget that runs action on other gadget when it is deserialized, and that second gadget runs more actions on a third gadget, and so on until a real dangerous action is triggered. That set of gadgets that can be used in a deserialization process to achieve dangerous actions is called "Gadget Chain".
|
||||
|
||||
Finding gadgets to build gadget chains is an active topic for security researchers. This kind of research usually requires to spend a big amount of time reading code.
|
@ -11,7 +11,7 @@ ObjectInputStream ois = new ObjectInputStream(is);
|
||||
AcmeObject acme = (AcmeObject)ois.readObject();
|
||||
----
|
||||
|
||||
It is expecting an `AcmeObject` object, but it will execute `readObject()` before the casting ocurs.
|
||||
It is expecting an `AcmeObject` object, but it will execute `readObject()` before the casting occurs.
|
||||
If an attacker finds the proper class implementing dangerous operations in `readObject()`, he could serialize that object and force the vulnerable application to perform those actions.
|
||||
|
||||
=== Class included in ClassPath
|
||||
|
@ -1,5 +1,5 @@
|
||||
=== Let's try
|
||||
The following input box receives a serialized object (a string) and it deserialzes it.
|
||||
The following input box receives a serialized object (a string) and it deserializes it.
|
||||
|
||||
```
|
||||
rO0ABXQAVklmIHlvdSBkZXNlcmlhbGl6ZSBtZSBkb3duLCBJIHNoYWxsIGJlY29tZSBtb3JlIHBvd2VyZnVsIHRoYW4geW91IGNhbiBwb3NzaWJseSBpbWFnaW5l
|
||||
|
Reference in New Issue
Block a user