Insecure Deserialization and No SQL injection

This week we are going to look at our final two web related topics

• Insecure Deserialization
• No SQL Injection

Insecure deserialization is another of the OWASP Top 10 Vulnerabilities Its commonly found in systems where data is encoded and passed between components. The consequences of insecure deserialization can be severe, with RCE or information leakage a high probability

We will also look at NoSQL injection. Like its more famous cousin SQL Injection, this is where a user is able to inject statements into database queries, and modify the types of data returned. Its also related to the insecure deserialization problem, as it depends on the way the database engine handles data passed in as part of the query.