{"id":15728,"date":"2019-07-10T10:00:29","date_gmt":"2019-07-10T09:00:29","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=15728"},"modified":"2021-07-07T16:15:02","modified_gmt":"2021-07-07T15:15:02","slug":"techniques-outils-deserialisation-java","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2019\/07\/techniques-outils-deserialisation-java\/","title":{"rendered":"Techniques et outils d\u2019attaque sur les moteurs de d\u00e9s\u00e9rialisation (Java)"},"content":{"rendered":"
\"\"<\/figure>\n
<\/div>\n
\n

Introduction<\/h1>\n<\/div>\n
La s\u00e9rialisation consiste \u00e0 transformer un objet applicatif en un format de donn\u00e9es pouvant \u00eatre restaur\u00e9 ult\u00e9rieurement. Ce proc\u00e9d\u00e9 est utilis\u00e9 pour sauvegarder des objets ou les envoyer dans le cadre de communications.<\/div>\n
<\/div>\n
\"\"<\/figure>\n
<\/div>\n

 <\/p>\n

Exemple de s\u00e9rialisation d’une variable de type String<\/i>\u00a0en Java:<\/div>\n
<\/div>\n
String<\/span> name<\/span> =<\/span> “Wavestone”<\/span>;<\/span>
\n<\/span>FileOutputStream<\/span> file<\/span> =<\/span> new<\/span> FileOutputStream<\/span>(<\/span>“file.bin”<\/span>);<\/span>
\n<\/span>ObjectOutputStream<\/span> out<\/span> =<\/span> new<\/span> ObjectOutputStream<\/span>(<\/span>file<\/span>);<\/span>
\n<\/span>out<\/span>.<\/span>writeObject<\/span>(<\/span>name<\/span>);<\/span><\/span><\/div>\n
<\/div>\n
Le fichier file.bin<\/b> contenant l\u2019objet name s\u00e9rialis\u00e9 a cette forme :<\/div>\n
<\/div>\n
AC ED 00 05 74 00 09 57 61 76 65 73 74 6f 6e 65<\/span> ….t..Wavestone<\/span><\/span><\/div>\n
<\/div>\n