Java Serialize 08

Bookmarked!

This challenge covers exploiting Object.equals(), triggered during HashSet and HashMap deserialization, as a gadget entry point.

Course

This exercise covers the exploitation of a serialization issue in Java by leveraging the equals() method during deserialization. You will learn how HashSet resolves hash collisions by calling equals(), enabling command execution.

Ready to practice?

Get access to this lab and 600+ hands-on exercises with a PRO subscription.