webPromedium

GhostRegister

hackerlab

Task: PHP 8.1 web app with login/registration storing serialized User object in cookie; profile.php deserializes it without validation. Solution: craft cookie with nested Output object in logger field to trigger __wakeup() → file_get_contents('/flag.txt') POP chain.

$ ls tags/ techniques/
file_readphpdeserializationobject_injectionunserializepop_chainmagic_methodscookie_tampering
php_object_injection_via_cookie_deserializationpop_chain_wakeup_magic_methodarbitrary_file_read_via_output_classcookie_tampering_for_auth_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups