Java Serialized Payloads
Summary: PortSwigger's BApp Store lists a third-party Burp extension, version 0.0.2a by Josh Summitt, last updated 10 February 2022, that generates various Java serialized payloads designed to execute OS commands. The listing states the extension can be used in three ways and carries an overall system impact rating of Low, with PortSwigger noting it makes no warranty about third-party extensions' quality or usefulness.
Bottom line: A freely installable Burp extension that produces Java serialized payloads for OS command execution puts a working deserialization attack kit in any tester's hands, and the listing's own Low impact rating covers the extension's footprint, not what its payloads do to a target.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026