Modifying serialized objects

Platform: PortSwigger | Category: Insecure Deserialization | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Insecure Deserialization

Summary

Walkthrough of the PortSwigger Web Security Academy lab Modifying serialized objects (Insecure Deserialization). This lab demonstrates a insecure deserialization vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Insecure Deserialization

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login with the credentials provided - wiener:peter.

Upon login we see that the user's cookie is a PHP serialize object.

The cookie contains a attribute called admin:0 which means false.

Change the boolean attribute to 1 & convert it back to proper encopding as it was before.

O:4:"User":2:{s:8:"username";s:6:"wiener";s:5:"admin";b:0;}

Upon replacing the old cookie in dev tools with the cookie that we have created , we can now see the hyperlink to access the admin panel.

We now have privilege to delete user accounts.

Delete the user carlos to solve the lab.

Key Takeaways / Lessons

• Understanding Insecure Deserialization detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Modifying serialized objects