Exploiting Java deserialization with Apache Commons
Log in to your own account and observe that the session cookie contains a serialized Java object. Send a request containing your session cookie to Burp Repeater.
Download the "ysoserial" tool and execute the following command:
java -jar path/to/ysoserial.jar CommonsCollections4 'rm /home/carlos/morale.txt' | base64
This will generate a Base64-encoded serialized object containing your payload.
In Burp Repeater, replace your session cookie with the malicious one you just created and URL-encode the entire value.
Send the request to solve the lab.