Insecure Deserialization

Cross-platform resources for Insecure Deserialization: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

Insecure Deserialization

This page aggregates cross-platform resources to practice Insecure Deserialization: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/deserialization

HTB machines practicing Insecure Deserialization (10)

Machine	OS	Difficulty
Celestial	Linux	MEDIUM
Feline	Linux	HARD
Jewel	Linux	MEDIUM
Json	Windows	MEDIUM
Laboratory	Linux	EASY
Monitors	Linux	HARD
NodeBlog	Linux	EASY
Scrambled	Windows	MEDIUM
Tenet	Linux	MEDIUM
Travel	Linux	HARD

PortSwigger labs practicing Insecure Deserialization (10)

Lab	Difficulty	Topic	Official
Developing a custom gadget chain for Java deserialization	APPRENTICE	Insecure Deserialization	Open
Developing a custom gadget chain for PHP deserialization	APPRENTICE	Insecure Deserialization	Open
Modifying serialized objects	APPRENTICE	Insecure Deserialization	Open
Using PHAR deserialization to deploy a custom gadget chain	APPRENTICE	Insecure Deserialization	Open
Arbitrary object injection in PHP	PRACTITIONER	Insecure Deserialization	Open
Exploiting Java deserialization with Apache Commons	PRACTITIONER	Insecure Deserialization	Open
Exploiting PHP deserialization with a pre-built gadget chain	PRACTITIONER	Insecure Deserialization	Open
Exploiting Ruby deserialization using a documented gadget chain	PRACTITIONER	Insecure Deserialization	Open
Modifying serialized data types	PRACTITIONER	Insecure Deserialization	Open
Using application functionality to exploit insecure deserialization	PRACTITIONER	Insecure Deserialization	Open

TryHackMe rooms practicing Insecure Deserialization (1)

Room	Difficulty	Type	Access	Official
Debug	MEDIUM	Challenge	🟢 Free	Open

Related skills

• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-06-07