Course
This exercise covers bypassing security mechanisms using SignedObject as a wrapper for double deserialization. You will learn how signature verification alone does not prevent deserialization attacks when getObject() triggers a second deserialization.
Ready to practice?
Get access to this lab and 600+ hands-on exercises with a PRO subscription.
