thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Gadget Chain

A sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, performs unintended actions.

Definition

Attackers do not inject new code; they chain together 'gadgets' already present in libraries such as Apache Commons Collections. This is why removing a single vulnerable library may not eliminate the risk and why class allowlisting matters.

Example

A deserialization payload chains library methods so that an object's readObject call ends up executing a system command.

Exam tip

Explains why deserialization is dangerous even without code injection.

Related terms