NEW
Font size
WorksheetsInsecure Deserialization Quiz
Total questions: 15
Worksheet time: 8mins
What is the process of converting an object into a format that can be stored or transmitted called?
Encoding
Serialization
Decoding
Deserialization
What is the main risk associated with insecure deserialization?
Data encryption
Data loss
Unauthorized access
Remote code execution
Which function is used in Python to convert an object into a binary format?
pickle.dump()
serialize()
pickle.load()
json.dumps()
What does the PHP unserialize() function do?
Compresses data
Encrypts data
Converts serialized data back to an object
Converts data to JSON
Which of the following is a sign of insecure deserialization vulnerability?
Use of encryption
User-controlled input
Data validation
Secure coding practices
What is the format of PHP serialized data?
Starts with \x04
Begins with \x80\x02
Starts with ACED 0005
Starts with O: or a:
Which magic method is called when an object is destroyed in PHP?
__destruct()
__construct()
__serialize()
__wakeup()
What is the purpose of the __wakeup() method in PHP?
To serialize an object
To initialize an object
To clean up resources
To unserialize an object
What is a common technique for exploiting insecure deserialization?
Input validation
Data encryption
Modifying serialized data
Data compression
Which of the following is a method to identify serialized data?
Use of encryption
Check for magic numbers
Data validation
Input sanitization
What can an attacker achieve through object injection?
Input validation
Data compression
Manipulation of internal objects
Data encryption
What is the first step in identifying vulnerabilities in code related to deserialization?
Check for user input
Check for encryption
Check for data validation
Check for logging
What is the format of Java serialized data?
Starts with O: or a:
Starts with \x04
Starts with ACED 0005
Begins with \x80\x02
What is a common sign of insecure deserialization?
User-controlled input
Data validation
Data encryption
Use of secure coding practices
What is the goal of injecting arbitrary objects in insecure deserialization?
To encrypt data
To trigger unintended functionality
To validate input
To compress data
