Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain

Black Hat via YouTube

Overview

Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
This course demonstrates how a Fastjson JSON deserialization vulnerability can bypass security checks and achieve remote code execution. It follows the exploit into Tron and LevelDB, including file access and post-penetration steps.

Syllabus

Introduction
Demo
Visualizing the serialized process
Autotype support
Autotype bypass
Magic Method
Derivation
JSONpath
Gen
Tron
ReadWrite
LevelDB
Red File
Read Files
Post Penetration

Taught by

Black Hat

Reviews

Start your review of How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.