Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

LAB: Developing a custom gadget chain for Java deserialization

Lyuben | Last updated: Jul 05, 2024 02:05PM UTC

Dear PortSwigger team, First of all, thank you for the great content and learning materials. Indeed, there are no other platforms that even come close to the Web Security Academy's level when it comes to web vulnerabilities. I have a question regarding the lab for developing custom gadget chains for Java deserialization. I was able to grasp everything except for one thing - why do we need to create a "productcatalog" subfolder in the Java structure? How are we supposed to find that out without looking at online solutions? Lastly, if there is one thing that can be improved in the Web Security Academy - its this. The lab walkthroughs often are merely reproduction steps. For some of the harder labs, it would be great to have some in-depth tutorial. In this particular case, the community solution also did not provide this information. Do you have any good suggestions where I can watch explanations of the solutions for the harder labs? I strongly believe that nothing can be learned if not understood first. Still, you have done an amazing job, thank you!

Ben, PortSwigger Agent | Last updated: Jul 08, 2024 10:08AM UTC

Hi Lyuben, I think this can be put down as a requirement for the lab itself rather than something you would necessarily need to 'know'. In terms of the solutions - we have taken the approach of providing some details of how the labs and vulnerabilities 'work' within the learning materials whilst simply providing the steps to solve the lab within the written solution. In some cases the community solutions will provide more details but if you are still struggling there might be other videos available on the internet (created by other users that have not submitted their solutions) that provide greater depth of explanation.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.