18.2 Lab: Exploiting Java deserialization with Apache Commons - Karthikeyan Nagaraj | 2024
A Simple writeup is posted on Medium - / cyberw1ng
Description - Portswigger Lab
This lab uses a serialization-based session mechanism and loads the Apache Commons Collections library. Although you don't have source code access, you can still exploit this lab using pre-built gadget chains.
To solve the lab, use a third-party tool to generate a malicious serialized object containing a remote code execution payload. Then, pass this object into the website to delete the morale.txt file from Carlos's home directory.
You can log in to your own account using the following credentials: wiener:peter
#cybersecurity #walkthrough #career search for: cyber wing, cyberwing, cyberw1ng, karthikeyan nagaraj