Java Object Deserializer
Summary: PortSwigger's BApp Store lists a Burp Suite extension called JDSer, version 0.9.1, that deserializes Java objects and encodes them in XML using the XStream library, rewritten from scratch to work with the Montoya API. Users load the JAR files containing the target classes in the JDSer tab, after which serialized Java content appears in a Java Object tab in Proxy History, Intercept, and Repeater, and edits to the XML serialize back when the tab is switched or the request is sent.
Key Takeaway: The extension exists so testers can read and modify serialized Java objects passing through Burp, and it ships with a sample application whose JAR is loaded the same way - a reminder that deserialization handling is a hands-on testing concern, not a theoretical one.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026