Freddy, Deserialization Bug Finder
Summary: Freddy is a Burp Suite extension, originally built by Nick Bloor for NCC Group, that actively scans for vulnerable Java and .NET serialization libraries. It draws on the Black Hat USA 2017 and Def Con 25 work by Alvaro Munoz and Oleksandr Mirosh on JSON and XML serialization libraries, plus Moritz Bechler's marshalsec research, which found that many such libraries serialize arbitrary runtime objects and let POP gadgets be controlled through serialized object properties.
Key Takeaway: The underlying research showed deserialization flaws in common Java and .NET libraries can lead to arbitrary code or command execution, so a scanner that only covers three detection methods for two runtimes leaves the YAML and AMF formats Freddy also supports as a gap worth knowing about.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026