The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab - Exploiting Java deserialization with Apache Commons

Kyle | Last updated: May 20, 2021 01:46AM UTC

Hi, I'm trying to solve the lab with the help of the Java Deserialization Scanner extension as for some reason I couldn't property encode the payload into base64 with the command mentioned in the solutions. When I do the command (through the extension) with how it says without | base64 but using the Attack Base64 option in the extension. Both as it is and after URL encoding the payload I get this error: org.apache.commons.lang3.SerializationException: java.io.UTFDataFormatException

Uthman, PortSwigger Agent | Last updated: May 20, 2021 10:31AM UTC

Hi Kyle, Can you try some of the steps outlined in the thread below? - https://forum.portswigger.net/thread/lab-exploiting-java-deserialization-with-apache-commons-b67b12ff Alternatively, you can try following along with the video below: - https://www.youtube.com/watch?v=pJ8jNil0fjU

Kyle | Last updated: May 21, 2021 12:24AM UTC