Modern Application Framework Issues and Serialization GWEB Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In the context of application security, what does serialization primarily do?

   • AIt encrypts data to protect it from unauthorized access
   • BIt compresses data to reduce network bandwidth usage
   • CIt converts an object into a format that can be stored or transmitted and later reconstructed
   • DIt validates user input to prevent injection attacks
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is assessing a Java application that deserializes data from a user-controlled cookie. The application has a filter that rejects cookies containing the string 'org.apache.commons.collections'. The tester wants to bypass the filter. Which approach is most likely to succeed?

   • AUse a different HTTP method to send the cookie, such as POST instead of GET.
   • BUse a different gadget chain that does not contain the blocked string in the serialized payload.
   • CAdd a null byte before the blocked string to evade the filter.
   • DEncode the entire cookie in base64 to hide the blocked string.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which code pattern is a strong indicator of unsafe deserialization?

   • ACalling a deserialization function on data received from an HTTP request without any validation
   • BStoring serialized objects in a database for later retrieval
   • CConverting an object to JSON and sending it to a client for display
   • DUsing a serialization library that is widely used and well-maintained
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Python web application receives a serialized object from a message queue. The object is used to update user profiles. The team wants to prevent deserialization attacks while minimizing code changes. Which approach should they choose?

   • AAdd a digital signature to the pickle payload using a shared secret.
   • BBase64-encode the pickle payload before sending it to the queue.
   • CUse pickle with a custom Unpickler that overrides find_class to allow only a set of safe classes.
   • DReplace pickle with a JSON-based serialization format and validate the schema before processing.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is investigating a suspected deserialization attack on a .NET application. The application uses BinaryFormatter to deserialize data from a message queue. The analyst finds that the application has a custom SerializationBinder that restricts types to a specific namespace. However, the attack succeeded. What is the most likely reason?

   • ABinaryFormatter is not vulnerable to deserialization attacks
   • BThe SerializationBinder was not applied to the BinaryFormatter instance
   • CThe attacker used a type that is in the allowed namespace but has a vulnerable gadget chain
   • DThe SerializationBinder only controls type resolution, but BinaryFormatter can still invoke methods on allowed types that have dangerous side effects
   Reveal Solution Discussion Select an answer first