preview

The Pros And Cons Of Respration System

Decent Essays

allowed to de-serialize and stops those classes from loading, forcefully making them non-deserializable. An example of this is the “org.apache.commons.collections.functors.InvokerTransformer” class that can be added to the list. This process is accomplished by checks made prior to the ObjectInputStream.resolveClass call. If the class being loaded is on the list of classes that should not be allowed, an UnsupportedOperationException is thrown instead of the resolveClass being loaded; the class is never loaded and thus is not deserializable. (Katenga, 2015)
Another option is to manually delete the InvokerTransformer class. This class is the main reason why the Java deserialization weakness is allowed to exploit systems. Although instead of …show more content…

Although, this is a feasible solution, it can be an expensive one to implement because of the amount of extra functionality that comes with the Burp Extender. It is also not supported across all servers and containers and therefore may not be feasible. (Portswigger, 2016)
The biggest problem is the knowledge of the attack port and domain that the system is running on. If these were changed and access is restricted, it would make it much more difficult for the attacker to exploit a system. A random port should therefore be assigned per domain and access to the servers restricted to only specific IP addresses which can be put on a whitelist. Embedded LDAP directories can be put into place that allows only specified users access to the server’s console and settings. However, an external LDAP directory is recommended as the embedded one can still be compromised. A Splunk report describing any changes to these directories should therefore be setup. This will notify administrators if any changes are made to
9 | P a g e the directory, such as the addition, modification or deletion of users that should otherwise not be.
Description of Application of Chosen Countermeasure
The method of attack chosen was to attack a WebLogic domain running on a Linux CentOS box making use of Kali Linux as the attackers chosen use of operating system. The attacker would then use the “ysoserial” tool to create a malicious payload. The “ysoserial” tool would then be used to send that

Get Access