Using application functionality to exploit insecure deserialization

Platform: PortSwigger | Category: Insecure Deserialization | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Insecure Deserialization

Summary

Walkthrough of the PortSwigger Web Security Academy lab Using application functionality to exploit insecure deserialization (Insecure Deserialization). This lab demonstrates a insecure deserialization vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Insecure Deserialization

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login using the credentials provided - wiener:peter.

In the my-account page, we see that there is a Delete Account option

We have a PHP serialized cookie where the User object attribute called avatar_link which points to users/wiener/avatar. When we click delete account button, the application takes the data from the serialized cookie & deletes the user account.

O:4:"User":3:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"bazx6dstvo4vawcwju7km2zg0q6zxzcb";s:11:"avatar_link";s:19:"users/wiener/avatar";}

If we modify the avatar_link attribute & point to to any other file on the server, we could potentially delete that file when the user account gets deleted.

For solving the lab, change the avatar_link attribute to /home/carlos/morale.txt & update the string length accordingly.

O:4:"User":3:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"bazx6dstvo4vawcwju7km2zg0q6zxzcb";s:11:"avatar_link";s:23:"/home/carlos/morale.txt";}

Now forward the request & it will delete the morale.txt which is in carlos's home directory.

Key Takeaways / Lessons

• Understanding Insecure Deserialization detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Using application functionality to exploit insecure deserialization