Java Serialize 14

Bookmarked!

This challenge covers Property-Oriented Programming, chaining JavaBeans getters and setters across ordinary-looking classes into a code-execution gadget.

Course

This exercise covers exploiting Java deserialization using TemplatesImpl to inject arbitrary bytecode. You will learn how to bypass blacklists by embedding malicious code as bytecode that executes via a static initializer.

Ready to practice?

Get access to this lab and 600+ hands-on exercises with a PRO subscription.