Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab - Exploiting Java deserialization with Apache Commons

Kyle | Last updated: May 20, 2021 01:46AM UTC

Hi, I'm trying to solve the lab with the help of the Java Deserialization Scanner extension as for some reason I couldn't property encode the payload into base64 with the command mentioned in the solutions. When I do the command (through the extension) with how it says without | base64 but using the Attack Base64 option in the extension. Both as it is and after URL encoding the payload I get this error: org.apache.commons.lang3.SerializationException: java.io.UTFDataFormatException

Uthman, PortSwigger Agent | Last updated: May 20, 2021 10:31AM UTC

Hi Kyle, Can you try some of the steps outlined in the thread below? - https://forum.portswigger.net/thread/lab-exploiting-java-deserialization-with-apache-commons-b67b12ff Alternatively, you can try following along with the video below: - https://www.youtube.com/watch?v=pJ8jNil0fjU

Kyle | Last updated: May 21, 2021 12:24AM UTC

Ok i tried it again but didnt work however then i thought to use ysoserial in Cygwin and then url encoded it and it worked, i think cause the newlines that needed to be there werent transferring from the Deserializer Extention to the decoder. Thank you for the help :)

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.