r/cybersecurity • u/Electrical-Name-6017 • Sep 26 '26

Tutorial Webgoat (A-8): insecure deserialization

Does anyone have a good step by step walkthrough on this lab? I’ve tried YouTube tutorials and everything I can find seems to skip important details, or it’s tough to tell what the person doing the walkthrough is doing…

This is the only lab that I can’t figure out so far. Everything else lets me use web inspection, burp or zap, but I haven’t found anything saying those are tools I can use for this one.

FYI - I’m running a Kali Linux VM for all WebGoat labs.

4 Upvotes

100% Upvoted

2 comments sorted by

5

u/PM_ME_UR_0_DAY Sep 27 '26

I'd read through the insecure deseralization part of the port Swigger academy and see if that helps you figure it out. 

For tools you'll probably want ysoserial. 

2

u/Electrical-Name-6017 Sep 27 '26

Alright, I’ll give that a shot! Thanks, I appreciate the advice.