1. Web Security Academy
  2. Insecure deserialization
  3. Exploiting
  4. Lab

Lab: Exploiting PHP deserialization with a pre-built gadget chain


This lab has a serialization-based session mechanism that uses a signed cookie. It also uses a common PHP framework. Although you don't have source code access, you can still exploit this lab's insecure deserialization using pre-built gadget chains.

To solve the lab, identify the target framework then use a third-party tool to generate a malicious serialized object containing a remote code execution payload. Then, work out how to generate a valid signed cookie containing your malicious object. Finally, pass this into the website to delete the morale.txt file from Carlos's home directory.

You can access your own account with the following credentials: wiener:peter