{"id":654,"date":"2021-11-08T10:26:49","date_gmt":"2021-11-08T09:26:49","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=654"},"modified":"2025-09-15T13:31:50","modified_gmt":"2025-09-15T13:31:50","slug":"java-deserialization-scanner-0-7-is-out","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/","title":{"rendered":"Java Deserialization Scanner 0.7 is out!"},"content":{"rendered":"<p>Hi!<\/p>\n<p>I just released <strong>version 0.7<\/strong> of the <strong>Java Deserialization Scanner<\/strong>, with a small improvement in the &#8220;Exploiting&#8221; tab.<\/p>\n<p>In this tab, it is possible to use the <strong>ysoserial<\/strong> tool to generate exploitation payloads, once the presence of a deserialization issue has been confirmed using either the &#8220;Manual testing&#8221; tab or the detection payloads added to Burp Suite&#8217;s scanner. Unfortunately, ysoserial is not entirely compatible with recent major versions of Java. To overcome this problem, it is now possible to set the full path of the Java binary used to run ysoserial in the &#8220;Configurations&#8221; pane.<\/p>\n<p><img decoding=\"async\" class=\"size-full wp-image-655 aligncenter\" src=\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/11\/JavaDeserializationScanner07-1.png\" alt=\"\" width=\"599\" height=\"269\" srcset=\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/11\/JavaDeserializationScanner07-1.png 599w, https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/11\/JavaDeserializationScanner07-1-300x135.png 300w, https:\/\/hnsecurity.it\/wp-content\/uploads\/2021\/11\/JavaDeserializationScanner07-1-350x157.png 350w\" sizes=\"(max-width: 599px) 100vw, 599px\" \/><\/p>\n<p>The new version of the plugin can be downloaded from <strong>my repository<\/strong> and it will soon be added to the <strong>BAppStore<\/strong>.<\/p>\n<ul>\n<li>Source code:\u00a0<a href=\"https:\/\/web.archive.org\/web\/20210312114921\/https:\/\/github.com\/federicodotta\/Java-Deserialization-Scanner\">https:\/\/github.com\/federicodotta\/Java-Deserialization-Scanner<\/a><\/li>\n<li>Release:\u00a0<a href=\"https:\/\/web.archive.org\/web\/20210312114921\/https:\/\/github.com\/federicodotta\/Java-Deserialization-Scanner\/releases\">https:\/\/github.com\/federicodotta\/Java-Deserialization-Scanner\/releases<\/a><\/li>\n<\/ul>\n<p>Finally, if you are exploiting deserialization issues, you may find <a href=\"https:\/\/github.com\/federicodotta\/ysoserial\">my ysoserial fork<\/a> useful. It adds <strong>DNS, time and OS-specific EXEC<\/strong> attack vectors, in addition to the classic ones based on EXEC, and many output processing functions to <strong>transform, compress, and encode the output of ysoserial<\/strong>. Furthermore, I integrated the code of some useful ysoserial pull requests not merged in the main repository, including <a href=\"https:\/\/github.com\/frohoff\/ysoserial\/pull\/76\">Isaac Sears&#8217;<\/a> <strong>XStream serializer<\/strong> and <a href=\"https:\/\/github.com\/frohoff\/ysoserial\/pull\/96\">Nicky Bloor&#8217;s<\/a> <strong>pure Java reverse<\/strong> shell attack vector.<\/p>\n<p>Cheers!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi! I just released version 0.7 of the Java Deserialization Scanner, with a small improvement in the &#8220;Exploiting&#8221; tab. In [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":159897,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[78,88],"tags":[104,105,106,107,115,77],"class_list":["post-654","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-exploits","category-tools","tag-burp-suite","tag-java","tag-java-deserialization-scanner","tag-java-serialization","tag-web","tag-exploit"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>HN Security - Java Deserialization Scanner 0.7 is out! -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HN Security - Java Deserialization Scanner 0.7 is out! -\" \/>\n<meta property=\"og:description\" content=\"Hi! I just released version 0.7 of the Java Deserialization Scanner, with a small improvement in the &#8220;Exploiting&#8221; tab. In [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/\" \/>\n<meta property=\"og:site_name\" content=\"HN Security\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-08T09:26:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-15T13:31:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"836\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Federico Dotta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@hnsec\" \/>\n<meta name=\"twitter:site\" content=\"@hnsec\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Federico Dotta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minuto\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/\"},\"author\":{\"name\":\"Federico Dotta\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/person\\\/e0e6046bd2bc829f7d945ad361bce702\"},\"headline\":\"Java Deserialization Scanner 0.7 is out!\",\"datePublished\":\"2021-11-08T09:26:49+00:00\",\"dateModified\":\"2025-09-15T13:31:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/\"},\"wordCount\":215,\"publisher\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/BURP.jpg\",\"keywords\":[\"Burp Suite\",\"Java\",\"Java Deserialization Scanner\",\"Java Serialization\",\"web\",\"exploit\"],\"articleSection\":[\"Exploits\",\"Tools\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/\",\"name\":\"HN Security - Java Deserialization Scanner 0.7 is out! -\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/BURP.jpg\",\"datePublished\":\"2021-11-08T09:26:49+00:00\",\"dateModified\":\"2025-09-15T13:31:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#primaryimage\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/BURP.jpg\",\"contentUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/BURP.jpg\",\"width\":1600,\"height\":836},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/java-deserialization-scanner-0-7-is-out\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Java Deserialization Scanner 0.7 is out!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#website\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\",\"name\":\"HN Security\",\"description\":\"Offensive Security Specialists\",\"publisher\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#organization\",\"name\":\"HN Security\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/hn-libellula.jpg\",\"contentUrl\":\"https:\\\/\\\/hnsecurity.it\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/hn-libellula.jpg\",\"width\":696,\"height\":696,\"caption\":\"HN Security\"},\"image\":{\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/hnsec\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/hnsecurity\\\/\",\"https:\\\/\\\/github.com\\\/hnsecurity\",\"https:\\\/\\\/infosec.exchange\\\/@hnsec\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/#\\\/schema\\\/person\\\/e0e6046bd2bc829f7d945ad361bce702\",\"name\":\"Federico Dotta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g\",\"caption\":\"Federico Dotta\"},\"url\":\"https:\\\/\\\/hnsecurity.it\\\/it\\\/blog\\\/author\\\/federico-dotta\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HN Security - Java Deserialization Scanner 0.7 is out! -","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/","og_locale":"it_IT","og_type":"article","og_title":"HN Security - Java Deserialization Scanner 0.7 is out! -","og_description":"Hi! I just released version 0.7 of the Java Deserialization Scanner, with a small improvement in the &#8220;Exploiting&#8221; tab. In [&hellip;]","og_url":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/","og_site_name":"HN Security","article_published_time":"2021-11-08T09:26:49+00:00","article_modified_time":"2025-09-15T13:31:50+00:00","og_image":[{"width":1600,"height":836,"url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","type":"image\/jpeg"}],"author":"Federico Dotta","twitter_card":"summary_large_image","twitter_creator":"@hnsec","twitter_site":"@hnsec","twitter_misc":{"Scritto da":"Federico Dotta","Tempo di lettura stimato":"1 minuto"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#article","isPartOf":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/"},"author":{"name":"Federico Dotta","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/person\/e0e6046bd2bc829f7d945ad361bce702"},"headline":"Java Deserialization Scanner 0.7 is out!","datePublished":"2021-11-08T09:26:49+00:00","dateModified":"2025-09-15T13:31:50+00:00","mainEntityOfPage":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/"},"wordCount":215,"publisher":{"@id":"https:\/\/hnsecurity.it\/it\/#organization"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#primaryimage"},"thumbnailUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","keywords":["Burp Suite","Java","Java Deserialization Scanner","Java Serialization","web","exploit"],"articleSection":["Exploits","Tools"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/","url":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/","name":"HN Security - Java Deserialization Scanner 0.7 is out! -","isPartOf":{"@id":"https:\/\/hnsecurity.it\/it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#primaryimage"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#primaryimage"},"thumbnailUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","datePublished":"2021-11-08T09:26:49+00:00","dateModified":"2025-09-15T13:31:50+00:00","breadcrumb":{"@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#primaryimage","url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","contentUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","width":1600,"height":836},{"@type":"BreadcrumbList","@id":"https:\/\/hnsecurity.it\/it\/blog\/java-deserialization-scanner-0-7-is-out\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hnsecurity.it\/it\/"},{"@type":"ListItem","position":2,"name":"Java Deserialization Scanner 0.7 is out!"}]},{"@type":"WebSite","@id":"https:\/\/hnsecurity.it\/it\/#website","url":"https:\/\/hnsecurity.it\/it\/","name":"HN Security","description":"Offensive Security Specialists","publisher":{"@id":"https:\/\/hnsecurity.it\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hnsecurity.it\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/hnsecurity.it\/it\/#organization","name":"HN Security","url":"https:\/\/hnsecurity.it\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/logo\/image\/","url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2026\/01\/hn-libellula.jpg","contentUrl":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2026\/01\/hn-libellula.jpg","width":696,"height":696,"caption":"HN Security"},"image":{"@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/hnsec","https:\/\/www.linkedin.com\/company\/hnsecurity\/","https:\/\/github.com\/hnsecurity","https:\/\/infosec.exchange\/@hnsec"]},{"@type":"Person","@id":"https:\/\/hnsecurity.it\/it\/#\/schema\/person\/e0e6046bd2bc829f7d945ad361bce702","name":"Federico Dotta","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/02d5d800b81f2a125ac23ee31a108ee2404d123bd3b722f2e263f0130cc1df42?s=96&d=mm&r=g","caption":"Federico Dotta"},"url":"https:\/\/hnsecurity.it\/it\/blog\/author\/federico-dotta\/"}]}},"jetpack_featured_media_url":"https:\/\/hnsecurity.it\/wp-content\/uploads\/2025\/09\/BURP.jpg","_links":{"self":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/comments?post=654"}],"version-history":[{"count":1,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/654\/revisions"}],"predecessor-version":[{"id":159980,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/posts\/654\/revisions\/159980"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/media\/159897"}],"wp:attachment":[{"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/media?parent=654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/categories?post=654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hnsecurity.it\/it\/wp-json\/wp\/v2\/tags?post=654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}