Portswigger Academy Insecure deserialisation Labs

Introduction

What?

Insecure deserialisation is when user-controllable data is deserialised by a website.

Why?

This potentially enables an attacker to manipulate serialised objects in order to pass harmful data into the application code.

How?

• Insecure deserialisation vulnerabilities

• Modifying serialised objects

• Modifying serialised data types

• Using application functionality to exploit insecure deserialisation

• Arbitrary object injection in PHP

• Exploiting Java deserialisation with Apache Commons

• Exploiting PHP deserialisation with a pre-built gadget chain

• Exploiting Ruby deserialisation using a documented gadget chain

• Developing a custom gadget chain for Java deserialisation

• Developing a custom gadget chain for PHP deserialisation

• Using PHAR deserialisation to deploy a custom gadget chain