Java Deserialization Badge

This badge covers the creation of java serilization object in order to exploit deserialization in Java

20 exercises 2 completed 8 videos

Exercises

Medium

PENTESTERLAB

CVE-2022-21724: JDBC RCE PostgreSQL

This challenge covers how to gain code execution by leveraging a JDBC connection string with PostgreSQL
1 video
Completed by 219 students
Takes < 1 Hr. on average
CWE-665

Easy

PENTESTERLAB

H2 RCE

This challenge covers how to gain code execution by leveraging an H2 database in a Java application
1 video
Completed by 161 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

JDBC RCE

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 85 students
Takes 2-4 Hrs. on average

Easy

PENTESTERLAB

Java Serialize 01

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 474 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 02

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 211 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 03

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 180 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 04

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 146 students
Takes < 1 Hr. on average

Medium

PENTESTERLAB

Java Serialize 05

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 104 students
Takes 1-2 Hrs. on average

Hard

PENTESTERLAB

Java Serialize 06

This exercise is one of our challenges to help you learn Java Serialisation exploitation
Completed by 80 students
Takes 2-4 Hrs. on average

Medium

PENTESTERLAB

Java Serialize 07

This challenge covers using readResolve() as a deserialization entry point to trigger a gadget chain after the object is restored.
Completed by 17 students
Java

Medium

PENTESTERLAB

Java Serialize 08

This challenge covers exploiting Object.equals(), triggered during HashSet and HashMap deserialization, as a gadget entry point.
Completed by 18 students
Java

Medium

PENTESTERLAB

Java Serialize 09

This challenge covers exploiting toString() through a wrapper class, the technique behind BadAttributeValueExpException in Commons Collections.
Completed by 17 students
Java

Medium

PENTESTERLAB

Java Serialize 10

This challenge covers chaining multiple classes together into a multi-class gadget chain, bridging single-class exploits to real-world attacks.
Completed by 15 students
Java

Medium

PENTESTERLAB

Java Serialize 11

This challenge covers building the Groovy1 gadget chain to reach remote code execution using only existing library classes.
Completed by 11 students
Java

Medium

PENTESTERLAB

Java Serialize 12

This challenge covers wrapping a payload in a SignedObject to bypass signature-based validation before deserialization.
Completed by 11 students
Java

Hard

PENTESTERLAB

Java Serialize 13

This challenge covers TemplatesImpl bytecode injection to execute arbitrary code during deserialization.
Completed by 4 students
Java

Hard

PENTESTERLAB

Java Serialize 14

This challenge covers Property-Oriented Programming, chaining JavaBeans getters and setters across ordinary-looking classes into a code-execution gadget.
Completed by 2 students
Java

Hard

PENTESTERLAB

Java Serialize 15

This capstone covers discovering a gadget chain yourself by analysing an unfamiliar library's classes, with no hints and deliberate red herrings.
Completed by 2 students
Java

Easy

PENTESTERLAB

Log4j RCE

This challenge covers the latest RCE in Log4j
1 video
Completed by 330 students
Takes < 1 Hr. on average

Easy

PENTESTERLAB

Log4j RCE II

This exercise is one of our challenges to help you learn Java Serialisation exploitation
1 video
Completed by 207 students
Takes 1-2 Hrs. on average