Tampering with a signed-but-unverified token

Deserialization rebuilds an object from bytes. When those bytes come from the client and the format can encode types or behaviour, a crafted payload can make the server construct objects it never meant to — changing state, or in the worst case running code, the moment it reads them.

This lab: Tampering with a signed-but-unverified token. Feed the server a serialized object it will trust and rebuild.

Work it against your own copy of the target. When you have the flag, submit it below.

Find where the app rebuilds an object from data you control, tamper with that data, and make the reconstruction do something in your favour. Capture the flag it yields.