Java Deserialization Attacks As I See Them

What is Serialization? Serialization means turning an object from memory into a flat format. The flat format can be bytes, JSON, or XML. After you serialize an object, you can send it over the network, save it to disk, or store it in a database. Deserialization is the opposite. It takes the flat format and builds the object back into memory. People use serialization for many things, not only for…