Java Deserialization Badge

This badge covers the creation of java serilization object in order to exploit deserialization in Java

20 exercises 8 videos

Exercises

Medium

PENTESTERLAB

CVE-2022-21724: JDBC RCE PostgreSQL

This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL
1 video
Completed by 212 students
Takes < 1 Hr. on average
CWE-665

Easy

PENTESTERLAB

H2 RCE

This challenge covers how to gain code execution by leveraging an H2 database in a Java application
1 video
Completed by 152 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

JDBC RCE

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 79 students
Takes 2-4 Hrs. on average

Easy

PENTESTERLAB

Java Serialize 01

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 464 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 02

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 202 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 03

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 173 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 04

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 139 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 05

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 98 students
Takes 1-2 Hrs. on average

Hard

PENTESTERLAB

Java Serialize 06

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 74 students
Takes 2-4 Hrs. on average

Medium

PENTESTERLAB

Java Serialize 07

This challenge covers using readResolve() as a deserialization entry point to trigger a gadget chain after the object is restored.
Completed by 5 students
Java

Medium

PENTESTERLAB

Java Serialize 08

This challenge covers exploiting Object.equals(), triggered during HashSet and HashMap deserialization, as a gadget entry point.
Completed by 5 students
Java

Medium

PENTESTERLAB

Java Serialize 09

This challenge covers exploiting toString() through a wrapper class, the technique behind BadAttributeValueExpException in Commons Collections.
Completed by 4 students
Java

Medium

PENTESTERLAB

Java Serialize 10

This challenge covers chaining multiple classes together into a multi-class gadget chain, bridging single-class exploits to real-world attacks.
Completed by 4 students
Java

Coming soon

Medium

PENTESTERLAB

Java Serialize 11

This challenge covers building the Groovy1 gadget chain to reach remote code execution using only existing library classes.
Java

Coming soon

Medium

PENTESTERLAB

Java Serialize 12

This challenge covers wrapping a payload in a SignedObject to bypass signature-based validation before deserialization.
Java

Coming soon

Hard

PENTESTERLAB

Java Serialize 13

This challenge covers TemplatesImpl bytecode injection to execute arbitrary code during deserialization.
Completed by 1 student
Java

Coming soon

Hard

PENTESTERLAB

Java Serialize 14

This challenge covers Property-Oriented Programming, chaining JavaBeans getters and setters across ordinary-looking classes into a code-execution gadget.
Completed by 1 student
Java

Coming soon

Hard

PENTESTERLAB

Java Serialize 15

This capstone covers discovering a gadget chain yourself by analysing an unfamiliar library's classes, with no hints and deliberate red herrings.
Completed by 1 student
Java

Easy

PENTESTERLAB

Log4j RCE

This challenge covers the latest RCE in Log4j
1 video
Completed by 321 students
Takes < 1 Hr. on average

Easy

PENTESTERLAB

Log4j RCE II

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 197 students
Takes 1-2 Hrs. on average