Skip to content

Add WSTG-INPV-22: Testing for Insecure Deserialization (Fixes #7)#1345

Open
Galaxy-sc wants to merge 2 commits intoOWASP:masterfrom
Galaxy-sc:feature/insecure-deserialization-issue-7
Open

Add WSTG-INPV-22: Testing for Insecure Deserialization (Fixes #7)#1345
Galaxy-sc wants to merge 2 commits intoOWASP:masterfrom
Galaxy-sc:feature/insecure-deserialization-issue-7

Conversation

@Galaxy-sc
Copy link
Copy Markdown
Contributor

This PR covers issue #7.

  • This PR handles the issue and requires no additional PRs.
  • You have validated the need for this change.

What did this PR accomplish?

Added a comprehensive guide for Testing for Insecure Deserialization (WSTG-INPV-22). Key highlights:

  • Identification: Patterns for Java, PHP, Python, .NET, and Node.js.
  • Modern Vectors: Added JSON deserialization (Jackson/Fastjson) and Prototype Pollution.
  • Exploitation: Structured strategy for Gadget Chains and OOB testing.
  • Remediation: Focus on integrity checks and digital signatures.

Fixes #7

@github-actions

This comment has been minimized.

@kingthorin kingthorin force-pushed the feature/insecure-deserialization-issue-7 branch from 6a059eb to d467827 Compare February 25, 2026 01:51
@kingthorin kingthorin force-pushed the feature/insecure-deserialization-issue-7 branch from d467827 to 2074655 Compare March 3, 2026 00:47
@kingthorin
Copy link
Copy Markdown
Collaborator

Please be aware that I won't be super active this week or next. If you aren't getting reviews it isn't for lack of appreciation, I'm just busy with some family stuff.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Testing for Deserialisation of Untrusted Data

2 participants