Insecure Deserialization Toy
A "remember me" cookie is a trusted, deserialized object. Add one field to grant yourself admin with zero login.
A "remember me" cookie that is a serialised object the server trusts and rebuilds. Add a field, and you are an administrator without ever logging in. In real systems this class reaches remote code execution.
How to use it
- Decode the cookie and read the object.
- Add or change a field.
- Re-encode it and watch the server trust it.
What to take away
Deserialising untrusted input is the flaw
Rebuilding an object from attacker-controlled bytes hands them influence over your program's state — and in many languages, over which code runs during construction.
Gadget chains turn this into RCE
Attackers assemble existing classes in the application's own dependencies into a chain that executes code purely as a side effect of deserialisation.
Use data formats, not object formats
Plain JSON parsed into a known structure carries none of this. Sign anything that must round-trip through the client.
Frequently asked questions
Which languages are affected?
All of the common ones — Java, PHP, Python pickle, .NET, Ruby. The specific gadgets differ; the class does not.
How is it fixed?
Do not deserialise untrusted data. Where you must round-trip state through a client, use a simple data format and verify an HMAC signature before parsing.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Mass Assignment Toy — A "update my profile" endpoint that binds whatever JSON you send straight to your account. Find the field that shouldn't be writable.
- JWT Forgery Lab — Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
- Webhook Signature Forgery Lab — Forge an HMAC-signed webhook without the secret, then flip on signature verification and watch it get rejected.
- XXE Playground — An XML upload feature that expands external entities. Smuggle a local file read through a "harmless" XML document.