Java-Deserialization-Scanner

Java-Deserialization-Scanner copied to clipboard

Error Newlines in headers are not allowed

4

So... This lab has a java deserialization in the cookie, which is base64 + url encoded https://portswigger.net/web-security/deserialization/exploiting/lab-deserialization-exploiting-java-deserialization-with-apache-commons When I send the request to Java deserialization scanner and I set the...

halfluke

Bumps commons-io from 2.6 to 2.7. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a...

dependabot[bot]

Invalid Payload makes attack buttons grayed out

1

Burp Version: Professional 2.0.11beta Java Deserialization Scanner v0.5 ysoserial-0.0.6-SNAPSHOT-all.jar compiled (on Windows) as follows: `mvn clean package -DskipTests -Dhibernate5` Noticed a problem where due to a typo, the extension gets...

mcgyver5

Fixed small typo.

SolomonSklash

ASCII hex generating false positives

1

ascii hex magic selected for detection translates to "aced" in ASCII which could be very well be a variable name or portion of text in variable. example variable name placed...

anantshri

Extension is not working with new version of Burp

4

Hello, First of all, thank you for creating such nice extension. I used Deserialization-Scanner efficiently with applications which potentially are vulnerable to Insecure JAVA Deserialization. Although after update of Burp...

LiliaNaumeiko

Scanner detected wrong library

2

While doing a vulnerable lab the scanner detected RCE using `CommonsCollections3` alt payloads 3 and 4 with gzip and base64. Exploitation was failing. A colleague suggested I brute force the...

nobodynate

Hi How can I add another way to recognize the scanner? Some sites use nginx and ping-dns cannot be used. For example, adding cmd to the header like this exploit:...

pentghost