Insecure Deserialization

Cross-platform resources for Insecure Deserialization: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Insecure Deserialization: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 21 challenges across 3 platforms — 10 HackTheBox · 10 PortSwigger · 1 TryHackMe. 10 with a Spanish writeup, 10 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Developing a custom gadget chain for Java deserialization (Apprentice) · 🇬🇧
2. PortSwigger — Developing a custom gadget chain for PHP deserialization (Apprentice) · 🇬🇧
3. PortSwigger — Modifying serialized objects (Apprentice) · 🇬🇧
4. PortSwigger — Using PHAR deserialization to deploy a custom gadget chain (Apprentice) · 🇬🇧
5. HackTheBox — Laboratory (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — NodeBlog (Fácil) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/deserialization

HTB machines practicing Insecure Deserialization (10)

Machine	OS	Difficulty	Writeup
Celestial	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Feline	Linux	HARD	🇪🇸 🇬🇧 📹
Jewel	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Json	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Laboratory	Linux	EASY	🇪🇸 🇬🇧 📹
Monitors	Linux	HARD	🇪🇸 🇬🇧 📹
NodeBlog	Linux	EASY	🇪🇸 🇬🇧 📹
Scrambled	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Tenet	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Travel	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Insecure Deserialization (10)

Lab	Difficulty	Topic	Official
Developing a custom gadget chain for Java deserialization	APPRENTICE	Insecure Deserialization	Open
Developing a custom gadget chain for PHP deserialization	APPRENTICE	Insecure Deserialization	Open
Modifying serialized objects	APPRENTICE	Insecure Deserialization	Open
Using PHAR deserialization to deploy a custom gadget chain	APPRENTICE	Insecure Deserialization	Open
Arbitrary object injection in PHP	PRACTITIONER	Insecure Deserialization	Open
Exploiting Java deserialization with Apache Commons	PRACTITIONER	Insecure Deserialization	Open
Exploiting PHP deserialization with a pre-built gadget chain	PRACTITIONER	Insecure Deserialization	Open
Exploiting Ruby deserialization using a documented gadget chain	PRACTITIONER	Insecure Deserialization	Open
Modifying serialized data types	PRACTITIONER	Insecure Deserialization	Open
Using application functionality to exploit insecure deserialization	PRACTITIONER	Insecure Deserialization	Open

TryHackMe rooms practicing Insecure Deserialization (1)

Room	Difficulty	Type	Access	Official
Debug	MEDIUM	Challenge	🟢 Free	Open

Related skills

• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-08-13