Exercises

This challenge covers TemplatesImpl bytecode injection to execute arbitrary code during deserialization.

This capstone covers discovering a gadget chain yourself by analysing an unfamiliar library's classes, with no hints and deliberate red herrings.

This challenge covers Property-Oriented Programming, chaining JavaBeans getters and setters across ordinary-looking classes into a code-execution gadget.

This challenge covers wrapping a payload in a SignedObject to bypass signature-based validation before deserialization.

This challenge covers building the Groovy1 gadget chain to reach remote code execution using only existing library classes.

A server-side input filter inspects every message before it reaches the AI model. Messages containing certain blocked keywords are rejected and never forwarded. If your message makes it past the filter, the model will answer freely.