---
id: 8195
title: "Java Deserialization Attacks with Burp"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/java-deserialization-attacks-burp/"
published_at: "2016-03-02T00:00:00Z"
tags: ["burp-extension", "web-pentesting", "java-deserialization", "ysoserial", "burp"]
phying_url: "https://phying.com/item/8195"
lang: en
---

# Java Deserialization Attacks with Burp

## Summary

Introduces the Java Serial Killer Burp extension for Java deserialization attacks, letting testers generate ysoserial-style payloads and inject them directly into proxied HTTP requests.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2016-03-02T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/java-deserialization-attacks-burp/
- **Phying News:** https://phying.com/item/8195