← All Challenges
Challenge 37 of 66
Object Breaker
🟠 Hard
Injection
+100 XP
A Java application deserializes user-supplied objects. Craft a malicious serialized object to achieve remote code execution.
The app uses Apache Commons Collections. Look for known gadget chains.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free