<commit_before>---
layout       : blocks/working-session
title        : New Top 10 - Deserialisation Vulnerabilities
type         : workshop
owasp-project: no
track        :
technology   :
related-to   :
status       : draft
organizers   : <NAME>
participants :
---

...intro text...

## Why

...why text...

## What

...what text...

## Who

... target audience ...

## References

 - "Deserialisation Vulnerabilities should have their own spot on the Top 10" - from [OWASP Top 10 2017 — What should be there?](https://medium.com/@JoshCGrossman/owasp-top-10-2017-what-should-be-there-f5500c1a938d)
 - https://frohoff.github.io/appseccali-marshalling-pickles/
 - https://blog.scrt.ch/2016/05/12/net-serialiception/
 - http://blog.websecurify.com/2017/02/hacking-node-serialize.html
 - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
 - https://lincolnloop.com/blog/playing-pickle-security/
 - https://www.notsosecure.com/remote-code-execution-via-php-unserialize/
 - http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
 - http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html
<commit_msg>Added Working Session to track<commit_after>---
layout       : blocks/working-session
title        : New Top 10 - Deserialisation Vulnerabilities
type         : workshop
track        : Owasp Top 10 2017
technology   :
related-to   :
status       : draft
organizers   : <NAME>
participants :
---

...intro text...

## Why

...why text...

## What

...what text...

## Who

... target audience ...

## References

 - "Deserialisation Vulnerabilities should have their own spot on the Top 10" - from [OWASP Top 10 2017 — What should be there?](https://medium.com/@JoshCGrossman/owasp-top-10-2017-what-should-be-there-f5500c1a938d)
 - https://frohoff.github.io/appseccali-marshalling-pickles/
 - https://blog.scrt.ch/2016/05/12/net-serialiception/
 - http://blog.websecurify.com/2017/02/hacking-node-serialize.html
 - https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
 - https://lincolnloop.com/blog/playing-pickle-security/
 - https://www.notsosecure.com/remote-code-execution-via-php-unserialize/
 - http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
 - http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html

{'fraction_non_alphanumeric': 0.15440289505428226, 'fraction_numerical': 0.04905508644953759, 'mean_word_length': 3.119205298013245, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 12, 'lorem ipsum': 0, 'www.': 2, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '536883', 'n_tokens_mistral': 992, 'n_tokens_neox': 861, 'n_words': 130}