Proving Ground·26 min
Hiroki Matsukuma
Shows how a class-instantiation weakness can bypass PHP __wakeup() guards inside deserialization gadget chains.
appsecwebvulnerabilities+2
DEF CON 34 talks are here: 354 talks, summarized and searchable.
Browse DEF CON 341 talk in the archive.
1–1 of 1 talk
Proving Ground·26 min
Hiroki Matsukuma
Shows how a class-instantiation weakness can bypass PHP __wakeup() guards inside deserialization gadget chains.