webPromedium
DecisionForge
hackadvisor
Task: Java enterprise app (DecisionForge) using JSF 1.2 with Apache MyFaces 1.1.10 storing unsigned/unencrypted serialized ViewState. Solution: Exploited Java deserialization via CommonsCollections6 gadget chain in ViewState to achieve blind RCE, copied flag to web-accessible uploads directory.
$ ls tags/ techniques/
honeypot_flag_identificationjsf_viewstate_deserializationcommons_collections_gadget_chainblind_rce_via_file_writejava_serialization_analysis
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 364 — PulseRelay — Path Traversal to RCE via Plugin Upload— hackadvisor
- [web][Pro]Lab 58 — ReportForge — SSRF via PDF Export Logo URL— hackadvisor
- [web][Pro]BillForge— hackadvisor
- [web][Pro]SendForge— hackadvisor
- [web][Pro]Lab 38 — PipelineForge — XXE in XML Pipeline Import— hackadvisor