Question

During a web application assessment, you intercept a POST request in Burp Suite and notice a base64-encoded parameter that decodes to a byte stream beginning with the hex signature 'AC ED 00 05'. The application is built on Apache Struts and uses this parameter to store session state. Which attack technique is MOST likely to lead to remote code execution against this endpoint?

Accepted Answer

Craft a malicious serialized Java object using a gadget chain (e.g., via ysoserial) and submit it in the parameter

Answer

Perform a UNION-based SQL injection by appending crafted SQL to the decoded parameter

Answer

Inject a stored XSS payload into the parameter to execute JavaScript in the admin's browser

Answer

Use HTTP parameter pollution to duplicate the parameter and bypass server-side validation