1. Web Security Academy
  2. Insecure deserialization
  3. Exploiting
  4. Lab

Lab: Developing a custom gadget chain for PHP deserialization


This lab uses a serialization-based session mechanism. By deploying a custom gadget chain, you can exploit its insecure deserialization to achieve remote code execution. To solve the lab, delete the morale.txt file from Carlos's home directory.

You can access your own account using the following credentials: wiener:peter

Try Burp Suite for Free

Find insecure deserialization vulnerabilities using Burp Suite

Try for free