FAIL: Attempted Pickle Exploitation
This weeks exploitation demonstrates how to gain code execution if you have control over a string using Pickle. Pickling is the process of converting a Python object hierarchy into a byte stream to be written to a file. This process is known as sterilization. The converse process, known as Unpickling, turns the byte stream back into a Python object. Pickle has the ability to both store and reproduce dictionaries, lists, and references to other objects. Additionally, it stores object attributes and restores them back into the same state. What is sterilization? According to one site, “Serialization is a mechanism to convert an object into stream of bytes so that it can be written into a file, transported through a network or stored into database” ( https://beginnersbook.com/2014/07/java-serialization/ ). Simply stated, sterilization is used by application to make their storage easier. According to Python’s documentation, The following types can be pickled ( https://docs.python.org/...