WCF Deserializer
Summary: The WCF Deserializer is a Burp Suite extension, authored by Jon Murray of NCC Group and last updated 15 June 2017, that deserializes binary SOAP objects so users can view and modify them before reserializing and sending them on. In Scanner mode it leaves messages deserialized so Burp can read the contents of deserialized objects, and it requires a Microsoft Windows environment.
Key Takeaway: The extension is a third-party BApp that PortSwigger states it makes no warranty about, and its last update was 15 June 2017 - so anyone relying on it to inspect binary SOAP traffic is running code that has gone nearly a decade without a refresh.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026