> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Insecure Deserialization

> Recursos cross-platform para Insecure Deserialization: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

# Insecure Deserialization

Esta página agrega los **recursos para practicar Insecure Deserialization** de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

## Recursos curados

| Fuente      | Enlace                                                                                                       |
| ----------- | ------------------------------------------------------------------------------------------------------------ |
| PortSwigger | [https://portswigger.net/web-security/deserialization](https://portswigger.net/web-security/deserialization) |

## Máquinas HTB que practican Insecure Deserialization (10)

| Máquina                                            | SO      | Dificultad                                           |
| -------------------------------------------------- | ------- | ---------------------------------------------------- |
| [Celestial](/htb/machines/linux/medio/celestial)   | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Feline](/htb/machines/linux/dificil/feline)       | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [Jewel](/htb/machines/linux/medio/jewel)           | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Json](/htb/machines/windows/medio/json)           | Windows | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Laboratory](/htb/machines/linux/facil/laboratory) | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [Monitors](/htb/machines/linux/dificil/monitors)   | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |
| [NodeBlog](/htb/machines/linux/facil/nodeblog)     | Linux   | <span className="dbadge dbadge-easy">EASY</span>     |
| [Scrambled](/htb/machines/windows/medio/scrambled) | Windows | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Tenet](/htb/machines/linux/medio/tenet)           | Linux   | <span className="dbadge dbadge-medium">MEDIUM</span> |
| [Travel](/htb/machines/linux/dificil/travel)       | Linux   | <span className="dbadge dbadge-hard">HARD</span>     |

## Labs PortSwigger que practican Insecure Deserialization (10)

| Lab                                                                                                                                                                                                     | Dificultad                                                 | Topic                    | Oficial                                                                                                                                                          |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Developing a custom gadget chain for Java deserialization](/portswigger/labs/deserialization/exploiting-deserialization-developing-a-custom-gadget-chain-for-java-deserialization)                     | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-developing-a-custom-gadget-chain-for-java-deserialization)           |
| [Developing a custom gadget chain for PHP deserialization](/portswigger/labs/deserialization/exploiting-deserialization-developing-a-custom-gadget-chain-for-php-deserialization)                       | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-developing-a-custom-gadget-chain-for-php-deserialization)            |
| [Modifying serialized objects](/portswigger/labs/deserialization/exploiting-deserialization-modifying-serialized-objects)                                                                               | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-modifying-serialized-objects)                                        |
| [Using PHAR deserialization to deploy a custom gadget chain](/portswigger/labs/deserialization/exploiting-deserialization-using-phar-deserialization-to-deploy-a-custom-gadget-chain)                   | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-using-phar-deserialization-to-deploy-a-custom-gadget-chain)          |
| [Arbitrary object injection in PHP](/portswigger/labs/deserialization/exploiting-deserialization-arbitrary-object-injection-in-php)                                                                     | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-arbitrary-object-injection-in-php)                                   |
| [Exploiting Java deserialization with Apache Commons](/portswigger/labs/deserialization/exploiting-deserialization-exploiting-java-deserialization-with-apache-commons)                                 | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-java-deserialization-with-apache-commons)                 |
| [Exploiting PHP deserialization with a pre-built gadget chain](/portswigger/labs/deserialization/exploiting-deserialization-exploiting-php-deserialization-with-a-pre-built-gadget-chain)               | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-php-deserialization-with-a-pre-built-gadget-chain)        |
| [Exploiting Ruby deserialization using a documented gadget chain](/portswigger/labs/deserialization/exploiting-deserialization-exploiting-ruby-deserialization-using-a-documented-gadget-chain)         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-ruby-deserialization-using-a-documented-gadget-chain)     |
| [Modifying serialized data types](/portswigger/labs/deserialization/exploiting-deserialization-modifying-serialized-data-types)                                                                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-modifying-serialized-data-types)                                     |
| [Using application functionality to exploit insecure deserialization](/portswigger/labs/deserialization/exploiting-deserialization-using-application-functionality-to-exploit-insecure-deserialization) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Insecure Deserialization | [Abrir](https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-using-application-functionality-to-exploit-insecure-deserialization) |

## Rooms TryHackMe que practican Insecure Deserialization (1)

| Room                            | Dificultad                                         | Tipo      | Acceso  | Oficial                                   |
| ------------------------------- | -------------------------------------------------- | --------- | ------- | ----------------------------------------- |
| [Debug](/tryhackme/rooms/debug) | <span className="dbadge dbadge-easy">MEDIUM</span> | Challenge | 🟢 Free | [Abrir](https://tryhackme.com/room/debug) |

## Skills relacionadas

* [/skills/rce](/skills/rce)

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"Insecure Deserialization","termCode":"insecure-deserialization","inLanguage":"es","url":"https://rootea.es/skills/insecure-deserialization","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"Máquinas HTB que practican Insecure Deserialization","numberOfItems":10,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/htb/machines/linux/medio/celestial","name":"Celestial"},{"@type":"ListItem","position":2,"url":"https://rootea.es/htb/machines/linux/dificil/feline","name":"Feline"},{"@type":"ListItem","position":3,"url":"https://rootea.es/htb/machines/linux/medio/jewel","name":"Jewel"},{"@type":"ListItem","position":4,"url":"https://rootea.es/htb/machines/windows/medio/json","name":"Json"},{"@type":"ListItem","position":5,"url":"https://rootea.es/htb/machines/linux/facil/laboratory","name":"Laboratory"},{"@type":"ListItem","position":6,"url":"https://rootea.es/htb/machines/linux/dificil/monitors","name":"Monitors"},{"@type":"ListItem","position":7,"url":"https://rootea.es/htb/machines/linux/facil/nodeblog","name":"NodeBlog"},{"@type":"ListItem","position":8,"url":"https://rootea.es/htb/machines/windows/medio/scrambled","name":"Scrambled"},{"@type":"ListItem","position":9,"url":"https://rootea.es/htb/machines/linux/medio/tenet","name":"Tenet"},{"@type":"ListItem","position":10,"url":"https://rootea.es/htb/machines/linux/dificil/travel","name":"Travel"}]}`}
</script>

*Última actualización: 2026-06-07*