https://florencenjeri.com/tags/insecure-deserialization/ Recent content in insecure deserialization on Florence Njeri Hugo -- gohugo.io en Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/exploiting-insecure-yaml-deserialization/ Mon, 06 Jul 2026 00:00:00 +0000 https://florencenjeri.com/posts/exploiting-insecure-yaml-deserialization/ Level 6: The Shape Shifter # This level was about insecure deserialization of YAML. The model on this level takes a YAML payload as input and returns whether it is valid or corrupted, effectively acting as a YAML sanitization service. The goal was to abuse the deserialization step to read the contents of flag.txt from the server. The exploit and result # Step 1: Reconnaissance I started by probing the model to understand what it actually does with the YAML input. I sent a valid YAML document and a broken one to confirm the behaviour: The response pattern confirmed that the model is a YAML sanitizer that simply parses my input and reports back whether the parse succeeded.