Serial Killer

Challenge Question

A session cookie on this web application is really a serialized object that the server trusts and rebuilds on every request. Deserialising data you control is dangerous, because rebuilding an object can trigger code. Find a class in the application that does something dangerous when it gets cleaned up, and craft a cookie that abuses it. This is a live challenge with its own instance.