Insecure Deserialization

Recursos cross-platform para Insecure Deserialization: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar Insecure Deserialization de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 21 retos en 3 plataformas — 10 HackTheBox · 10 PortSwigger · 1 TryHackMe. 10 con writeup en español, 10 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — Developing a custom gadget chain for Java deserialization (Apprentice) · 🇬🇧
2. PortSwigger — Developing a custom gadget chain for PHP deserialization (Apprentice) · 🇬🇧
3. PortSwigger — Modifying serialized objects (Apprentice) · 🇬🇧
4. PortSwigger — Using PHAR deserialization to deploy a custom gadget chain (Apprentice) · 🇬🇧
5. HackTheBox — Laboratory (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — NodeBlog (Fácil) · 🇪🇸 🇬🇧 📹

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/deserialization

​

Máquinas HTB que practican Insecure Deserialization (10)

Máquina	SO	Dificultad	Writeup
Celestial	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Feline	Linux	HARD	🇪🇸 🇬🇧 📹
Jewel	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Json	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Laboratory	Linux	EASY	🇪🇸 🇬🇧 📹
Monitors	Linux	HARD	🇪🇸 🇬🇧 📹
NodeBlog	Linux	EASY	🇪🇸 🇬🇧 📹
Scrambled	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Tenet	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Travel	Linux	HARD	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican Insecure Deserialization (10)

Lab	Dificultad	Topic	Oficial
Developing a custom gadget chain for Java deserialization	APPRENTICE	Insecure Deserialization	Abrir
Developing a custom gadget chain for PHP deserialization	APPRENTICE	Insecure Deserialization	Abrir
Modifying serialized objects	APPRENTICE	Insecure Deserialization	Abrir
Using PHAR deserialization to deploy a custom gadget chain	APPRENTICE	Insecure Deserialization	Abrir
Arbitrary object injection in PHP	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting Java deserialization with Apache Commons	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting PHP deserialization with a pre-built gadget chain	PRACTITIONER	Insecure Deserialization	Abrir
Exploiting Ruby deserialization using a documented gadget chain	PRACTITIONER	Insecure Deserialization	Abrir
Modifying serialized data types	PRACTITIONER	Insecure Deserialization	Abrir
Using application functionality to exploit insecure deserialization	PRACTITIONER	Insecure Deserialization	Abrir

​

Rooms TryHackMe que practican Insecure Deserialization (1)

Room	Dificultad	Tipo	Acceso	Oficial
Debug	MEDIUM	Challenge	🟢 Free	Abrir

​

Skills relacionadas

• /skills/rce

---

← Volver al glosario completo

Última actualización: 2026-08-13