New to this? Try a free practice lab — a scripted hacking challenge in your browser, no account needed.
What you'll do
Insecure Deserialization occurs when the web application takes a serialized object, that has been exposed to the user and possibly tampered with, and converts it back into an object.
Several things can happen when a web application deserializes content that comes from an end user
If the object contains any information related to security, authorization level, or authentication information, the user can change that information and potentially elevate their privilege level
Depending on the system being used and the way in which objects are being deserialized, it may enable remode code execution
We will explore both of these possibilties in this lab, in the context of Python and Java
