Java Serialize 07

Bookmarked!

This challenge covers using readResolve() as a deserialization entry point to trigger a gadget chain after the object is restored.

PRO Medium 0 Java Deserialization Badge

Course

This exercise covers the exploitation of a serialization issue in Java using the readResolve() lifecycle method as an entry point for gadget chains. You will learn how readResolve() operates on fully deserialized fields under attacker control.

Ready to practice?

Get access to this lab and 600+ hands-on exercises with a PRO subscription.

Go PRO or create a free account