Insecure deserialization active scanner

[omerlh]

As already discussed in #3883, this is now part of the new Top 10 - A8. Could be cool to add such an active scan rule - based on this tool could be a good start for .NET...

[kingthorin]

Other projects or info:

• https://github.com/federicodotta/Java-Deserialization-Scanner (Includes vuln apps.)
• Java version of yoserial: https://github.com/frohoff/ysoserial
• https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/

[kingthorin]

https://github.com/pwntester/ysoserial.net

[sixsec]

Another Project that could maybe be ported:
https://github.com/nccgroup/freddy

[NF997]

Has anyone already started to work on this?

[thc202]

I don't think so.

[ssyms]

I would potentially be interested in this if it's still open? I couldn't find an insecure deserialization rule in the Active Scan docs, but just want to be sure

[kingthorin]

This is definitely still available.

[ssyms]

Awesome, will start looking into it

[pranavsaxena17]

@ssyms Are you still on this? I would like to look into this.

[ssyms]

@pranavsaxena17 Yes, I've been a bit busy since the New Year but I have done some work on it and would like to finish.

[jangelesg]

Id like to start working on this one; any suggestion I'm new to the team

Greetings

[ssyms]

Hi Jon, I am done implementing functionality for Java deserialization, just working on adding tests. Maybe you could look into integrating the .NET tool? (https://github.com/pwntester/ysoserial.net)

[jangelesg]

Hi Jon, I am done implementing functionality for Java deserialization, just working on adding tests. Maybe you could look into integrating the .NET tool? (https://github.com/pwntester/ysoserial.net)

I will

[ricekot]

@ssyms @jangelesg how are things going? do you need any help with this issue?

[ssyms]

@ricekot I'm open to this ticket being re-assigned. A lot of personal stuff has come up in the past year and I'm still busy dealing with it.