DeserAuth v2.0 - Deserialized Message Editor Tab

What's New

Deserialized Message Editor Tab - DeserAuth now adds a "Deserialized" tab alongside Pretty/Raw/Hex in Burp's message editors, just like how the JWT extension decodes JSON Web Tokens. Java serialized objects are decoded into a human-readable, editable view in real-time.

Highlights

• See inside serialized objects - class names, method calls, field values, Hashtable entries, all decoded from the binary stream into a structured text view
• Edit values live - modify strings, numbers, and booleans directly in the text view. Changes are reconstructed back into valid serialized binary using DeserAuth's proven swap engine
• Apply button - click Apply to commit edits and verify the reconstructed binary in Raw/Pretty before sending
• Works everywhere - the tab appears in Proxy (intercept + history), Repeater, Intruder, Scanner, and any extension that uses Burp's standard message editor (Stepper, Logger++, Autorize, etc.)
• Full protocol support - parses TC_OBJECT, TC_STRING, TC_ARRAY, TC_CLASSDESC, TC_REFERENCE, TC_ENUM, TC_BLOCKDATA, TC_PROXYCLASSDESC, and all Java primitive types
• Graceful degradation - exotic or custom-serialized structures are partially parsed with remaining data shown as hex

Example

Before (Raw):

AC ED 00 05 73 72 00 3A 6F 72 67 2E 73 70 72 69 ...

After (Deserialized tab):

[Object] org.springframework.remoting.support.RemoteInvocation
  methodName (String) = "getUserProfile"
  parameterTypes:
    [Ljava.lang.Class;] length=1
      [0]: (String) = "java.lang.String"
  arguments:
    [Ljava.lang.Object;] length=1
      [0]: (String) = "admin_user"

All existing features preserved

Passive analysis, right-click context menu (Same/Any/Batch/Saved Rule), export (CSV/HTML/XML/Excel), and the swap engine all work exactly as before.

Full Changelog

See CHANGELOG in README

---

DeserAuth v1.2.1 - Stability & BApp Store Compliance

DeserAuth v1.2.1

Minor update focused on stability, compatibility, and BApp Store compliance.

Changes

• Added UTF-8 encoding declaration for compatibility with all Burp/Jython versions
• Added clean unload support (IExtensionStateListener + extensionUnloaded())
• Added clickable author attribution and GitHub link in extension UI
• Added proper dialog parent frame reference
• Fixed import issues (BorderFactory, MouseAdapter, Cursor, Desktop, URI)
• Fixed duplicate class declaration syntax error
• Improved BApp Store acceptance compliance (criteria #5, #7, #10)

Full Changelog

v1.2.0...v1.2.1

DeserAuth v1.2.0 - Deserialization Authorization Analyzer

DeserAuth v1.2.0

Deserialization Authorization Analyzer — A Burp Suite extension for automated authorization testing in Java serialized communication.

Features

Passive Automatic Analysis

• Intercepts matching requests across all Burp tools
• Automatically replays with modified serialized values
• Compares responses with color-coded results (SAME / SIMILAR / DIFFERENT)

Manual Right-Click Actions

• Send to Repeater (Same Length)
• Send to Repeater (Any Length - patches length prefixes)
• Send to Repeater (Batch - comma-separated payloads)
• Send to Repeater using Saved Rule

Smart Serialization Handling

• Java char[] buffer replacement with null-padding awareness
• TC_STRING 2-byte length prefix auto-patching
• Array size (4-byte) prefix patching for buffer expansion
• UTF-16BE and ASCII string detection

Results & Reporting

• Sortable results table
• Side-by-side request/response comparison viewers
• Export to CSV, HTML, XML, Excel
• Configurable field selection for exports
• Diff percentage calculation

Scope Coverage

Works across: Proxy, Repeater, Intruder, Scanner, Sequencer, Spider, Extender, Target

Requirements

• Burp Suite Professional or Community Edition
• Jython Standalone JAR (2.7.x)

Installation

1. Set Jython JAR path in Extender → Options → Python Environment
2. Extender → Add → Extension Type: Python → Select [deserauth.py](https://deserauth.py)
3. New "DeserAuth" tab appears in Burp

Author

Yuthan Balaji K — @iamyuthan