PT2 · Module 3
Advanced Server-Side Attacks
SSRF to cloud metadata, deserialization gadget chains, path traversal and file inclusion, race condition exploitation, and prototype pollution to RCE.
~12 h 8 resources Last updated October 4, 2026
Server-side attacks exploit the way an application processes input the server itself trusts. The surface is wide: URLs the backend fetches on behalf of the user, serialized objects the application rebuilds from a cookie, file paths derived from parameters, data races between concurrent requests, and JavaScript object prototypes shared across the entire runtime. PT2 tests whether you can take any of them from a quiet primitive to RCE or sensitive-data exfiltration.
SSRF And Cloud Metadata
SSRF turns the server into a proxy for the attacker. The highest-impact chain is AWS IMDS at 169.254.169.254: scrape the IAM role name, pull short-lived credentials, and act as that role across every service it is attached to. GCP and Azure expose equivalent metadata endpoints. Beyond the cloud, SSRF reaches internal admin panels, scans internal networks, and (via gopher) smuggles arbitrary bytes into unauthenticated internal services.
Deserialization
Serialized data a user controls, deserialized by the server, becomes code execution when a gadget chain exists in the application's dependencies. ysoserial for Java, phpggc for PHP, and ysoserial.net for .NET maintain curated chains per common library. Python pickle and YAML !!python/object are even more direct: both deserialize arbitrary callables by default. ViewState, JSON.NET TypeNameHandling, and BinaryFormatter are the usual .NET entry points.
Path Traversal And File Inclusion
Any parameter that references a file is a candidate. Traversal reads sensitive files (/etc/passwd, /etc/shadow, framework config); file inclusion goes further and executes code when the included file is interpreted (PHP, JSP, templating engines). Filter bypasses stack: URL encoding, double encoding, nested sequences, absolute paths, and null-byte truncation on older runtimes.
Race Conditions
Business logic that checks state and then acts on it is vulnerable when two requests overlap between the check and the act. HTTP/2 single-packet attacks collapse the request window to microseconds. Classic targets: coupon redemption, balance withdrawals, vote counting, invite acceptance, account creation uniqueness.
Prototype Pollution
A client-side quirk that becomes server-side RCE when polluted properties flow into child_process.spawn, EJS template rendering, or access-control checks. Vulnerable library versions (lodash, minimist, set-value) are the entry points to look for.
Chaining
Server-side primitives chain horizontally: SSRF to IMDS to cloud account takeover; path traversal to source leak to deserialization gadget discovery; prototype pollution to RCE through the templating engine. The exam rewards finding the primitive, then asking what each one unlocks downstream.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 9 min readInsecure DeserializationFocus on #Java Deserialization with ysoserial #Identifying the Gadget Chain #Python Pickle Deserialization #Python YAML Deserialization #PHP Deserialization with phpggc #.NET Deserialization with ysoserial.net #ViewState Deserialization #BinaryFormatter and ObjectDataProvider #JSON.NET TypeNameHandling #Detecting .NET Deserialization Targets #When Deserialization Fails
Practice
Apply the module hands-on.
- Insecure Deserialisation TryHackMe Medium
- SSRF TryHackMe Medium
- File Inclusion, Path Traversal TryHackMe Medium
- Race Conditions TryHackMe Medium
- Prototype Pollution TryHackMe Medium
- Include TryHackMe Medium
- Nunchucks HackTheBox Easy
- BountyHunter HackTheBox Easy
- Pollution HackTheBox Hard
- Travel HackTheBox Hard