Skip to content

DeserAuth v1.2.0 - Deserialization Authorization Analyzer

Choose a tag to compare

View all tags
@iamyuthan iamyuthan released this 27 May 04:27
· 6 commits to Master since this release
v1.2.0
b7a36f1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

DeserAuth v1.2.0

Deserialization Authorization Analyzer — A Burp Suite extension for automated authorization testing in Java serialized communication.

Features

Passive Automatic Analysis

  • Intercepts matching requests across all Burp tools
  • Automatically replays with modified serialized values
  • Compares responses with color-coded results (SAME / SIMILAR / DIFFERENT)

Manual Right-Click Actions

  • Send to Repeater (Same Length)
  • Send to Repeater (Any Length - patches length prefixes)
  • Send to Repeater (Batch - comma-separated payloads)
  • Send to Repeater using Saved Rule

Smart Serialization Handling

  • Java char[] buffer replacement with null-padding awareness
  • TC_STRING 2-byte length prefix auto-patching
  • Array size (4-byte) prefix patching for buffer expansion
  • UTF-16BE and ASCII string detection

Results & Reporting

  • Sortable results table
  • Side-by-side request/response comparison viewers
  • Export to CSV, HTML, XML, Excel
  • Configurable field selection for exports
  • Diff percentage calculation

Scope Coverage

Works across: Proxy, Repeater, Intruder, Scanner, Sequencer, Spider, Extender, Target

Requirements

  • Burp Suite Professional or Community Edition
  • Jython Standalone JAR (2.7.x)

Installation

  1. Set Jython JAR path in Extender → Options → Python Environment
  2. Extender → Add → Extension Type: Python → Select [deserauth.py](https://deserauth.py)
  3. New "DeserAuth" tab appears in Burp

Author

Yuthan Balaji K — @iamyuthan

Assets 3
Loading