Java Deserialization Scanner
Summary: PortSwigger's BApp Store lists a Burp Suite extension, authored by Federico Dotta and updated 04 February 2022, that adds active and passive scanner checks for Java deserialization vulnerabilities plus a manual tab. It supports payloads in Raw, Base64, Ascii Hex, GZIP, and Base64 GZIP encodings for loaded libraries, adds a URLSNDS payload to detect deserialization on the backend without a vulnerable library, and offers an exploitation tab built on frohoff's ysoserial.
What you should know: The extension's URLSNDS check is pitched as safe to add to the active scanner, while the existing CPU payload is flagged for use with caution - a reminder that deserialization probing can itself stress a target JVM. It is third-party code that PortSwigger states it makes no warranty about.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026