Modifying serialized data types

Platform: PortSwigger | Category: Insecure Deserialization | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Insecure Deserialization

Summary

Walkthrough of the PortSwigger Web Security Academy lab Modifying serialized data types (Insecure Deserialization). This lab demonstrates a insecure deserialization vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Insecure Deserialization

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login to the site using the credentials provided - wiener:peter.

The session cookie of wiener is a PHP serialized cookie.

O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"jgl7shbmu6leid1be7yqofzru4g17uw8";}

Tried to change the username attribute to administrator, it didn't work but it revealed the logic that was used behind .

O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";s:32:"jgl7shbmu6leid1be7yqofzru4g17uw8";}

From the below image , we can see that there are 3 sets of access tokens & one of it is wiener's.The devs have used loose comparision operator for verification logic. So from this we understood that we need to somehow match the access token with the correct one in the array to gain admin privileges.

Now we can change the access token's attribute's value to an integer - 0 so that PHP v7.x used in the backend performs loose comparison & this the statement will become true.

O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";i:0;}

Now we do have admin panel access.

Delete the user carlos to solve the lab.

Key Takeaways / Lessons

• Understanding Insecure Deserialization detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Modifying serialized data types