Lab: Developing a custom gadget chain for Java deserialization

Summary: PortSwigger's Web Security Academy lab presents a Java deserialization exercise in which a serialization-based session mechanism can be exploited by constructing a suitable gadget chain to obtain the administrator's password. The lab directs users to gain access to the source code, build the gadget chain, log in as administrator, and delete the user carlos, with a provided Java program for serializing objects and a ready-to-use program that serializes a ProductTemplate with a chosen payload.
What's compelling: The lab's path to the administrator password runs through a gadget chain assembled from application source code, which is the same material an attacker with a leaked or exposed codebase would work from against a deserialization endpoint.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026