Sour Pickles

Slaviero, M. (2011). Sour Pickles: A Serialised Exploitation Guide in One Hundred Slides or Fewer.

Type

Conference paper

Intellectual base

Primary research

Year

2011

Link

no authoritative link yet

Cited by

1 citation across 1 artifact.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Insecure Deserialization
  • Python's pickle protocol executes arbitrary Python via the __reduce__ protocol during unpickling, making any service that unpickles network-supplied data directly exploitable for remote code execution

    This sourceIt does not reach the machine-learning model-loader surface, a later development that is not cited to this talk. Sour Pickles circulates under two subtitles — "A Serialised Exploitation Guide in One Hundred Slides or Fewer" and "...in One Part"; the form given above is one of them.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:4499360083c6 · see in the full table