Lab: Using application functionality to exploit insecure deserialization

1. Log in to your own account. On the "My account" page, notice the option to delete your account by sending a POST request to /my-account/delete.
2. Send a request containing a session cookie to Burp Repeater.
3. In Burp Repeater, study the session cookie using the Inspector panel. Notice that the serialized object has an avatar_link attribute, which contains the file path to your avatar.

4. Edit the serialized data so that the avatar_link points to /home/carlos/morale.txt. Remember to update the length indicator. The modified attribute should look like this:

   s:11:"avatar_link";s:23:"/home/carlos/morale.txt"
5. Click "Apply changes". The modified object will automatically be re-encoded and updated in the request.
6. Change the request line to POST /my-account/delete and send the request. Your account will be deleted, along with Carlos's morale.txt file.

Emanuele Picariello