# Relay — Insecure Deserialization (lab)

> Relay is a team workspace that remembers your UI preferences by storing them in a cookie and loading them on every visit.

Canonical: https://codelivly.com/labs/insecure-deserialization

| | |
|---|---|
| Type | Web |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 30 min |
| Completions | 6 |

Relay is a team workspace that remembers your UI preferences by storing them in a cookie and loading them on every visit. The preferences are stored in a format that can rebuild arbitrary objects — and the server rebuilds whatever you send it. Forge a preferences cookie that runs a command on the server and read the flag from its environment.

## Objective

Learn insecure deserialization: when a server rebuilds objects from untrusted data using a format like Python pickle, an attacker can make it run arbitrary code during deserialization (RCE).

## Tasks

1. Inspect the cookie
2. Understand the sink
3. Build a malicious pickle
4. Send it as the cookie
5. Capture the flag

## Related

- [All labs](https://codelivly.com/practice?type=lab)