How to take advantage of pikachu deserialization vulnerability in PHP

In this issue, the editor will bring you about how to use pikachu deserialization loopholes in PHP. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.

Brief introduction to PHP deserialization vulnerability:

Php programs provide methods for serialization in order to save and dump objects. Php serialization is generated to dump objects while the program is running. Serialization converts an object to a string, but retains only the member variables in the object, not the function methods.

PHP serialize () function

The serialize () function serializes an object or array and returns a string.

After serializing the object, the serialize () function can easily pass it to other places where it is needed, and its type and structure will not change. If you want to change the serialized string back to the value of PHP, use unserialize ().

PHP unserialize () function

The unserialize () function is used to deserialize the object or array serialized by the serialize () function and return the original object structure.

Serialize serialize ()

In popular terms, it is to turn an object into a string that can be transmitted.

Deserialize unserialize ()

Is to restore the serialized string to an object and then continue to use it in the rest of the code.

Cause:

There is no problem with serialization and deserialization itself, but if the content of deserialization is controlled by the user, and the background improperly uses magic functions in PHP, it will lead to security problems.

Enter payload:O:1: "S": 1: {payload:O:1 4: "test"; SRAV 29: "alert ('xss')";} XSS pop-up window

PHP deserialization is generally found when the code is audited, and other conditions are not easy to find.

This is how to use pikachu deserialization loopholes in PHP shared by Xiaobian. If you happen to have similar doubts, you might as well refer to the above analysis to understand. If you want to know more about it, you are welcome to follow the industry information channel.