🧪 Labs › Injection
Insecure Deserialization
Severity: High
Turning attacker-controlled bytes back into live objects can run attacker code.
What it is
Deserialization rebuilds an object from a byte stream. If an app deserializes data an attacker controls — a cookie, an import file, a message — the act of reconstructing the object can trigger code: constructors, callbacks, and 'gadget chains' assembled from classes already on the server.
Unlike parsing data, deserialization can instantiate behaviour, which is why it jumps straight to code execution in many stacks.
The root cause is trusting a serialized blob you didn't produce.
How to approach it
- Find where the app accepts and deserializes structured state — a token, an uploaded object, a profile import.
- Identify the format and framework; each has known gadget sources.
- Test whether tampered serialized input is accepted and what the deserialization does with it.
- Reason from a reconstructed object to a chain that reaches an effect.
Your task
Supply crafted serialized data that the service turns into an action it never intended.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Don't deserialize untrusted data; prefer simple data formats (JSON) with explicit parsing.
- If you must, sign/verify integrity first and restrict allowed types to a strict allowlist.
- Keep frameworks patched and gadget-free where possible.
More Injection labs
- SQL Injection — Make the database answer a question the application never meant to ask.
- Server-Side Template Injection (SSTI) — When user input becomes part of a server template, the template engine runs it.
- XML External Entities (XXE) — A permissive XML parser can be told to fetch files and URLs for you.
- OS Command Injection — A feature that shells out to a system command, with your input in the command line.