What's New
Deserialized Message Editor Tab - DeserAuth now adds a "Deserialized" tab alongside Pretty/Raw/Hex in Burp's message editors, just like how the JWT extension decodes JSON Web Tokens. Java serialized objects are decoded into a human-readable, editable view in real-time.
Highlights
- See inside serialized objects - class names, method calls, field values, Hashtable entries, all decoded from the binary stream into a structured text view
- Edit values live - modify strings, numbers, and booleans directly in the text view. Changes are reconstructed back into valid serialized binary using DeserAuth's proven swap engine
- Apply button - click Apply to commit edits and verify the reconstructed binary in Raw/Pretty before sending
- Works everywhere - the tab appears in Proxy (intercept + history), Repeater, Intruder, Scanner, and any extension that uses Burp's standard message editor (Stepper, Logger++, Autorize, etc.)
- Full protocol support - parses TC_OBJECT, TC_STRING, TC_ARRAY, TC_CLASSDESC, TC_REFERENCE, TC_ENUM, TC_BLOCKDATA, TC_PROXYCLASSDESC, and all Java primitive types
- Graceful degradation - exotic or custom-serialized structures are partially parsed with remaining data shown as hex
Example
Before (Raw):
AC ED 00 05 73 72 00 3A 6F 72 67 2E 73 70 72 69 ...
After (Deserialized tab):
[Object] org.springframework.remoting.support.RemoteInvocation
methodName (String) = "getUserProfile"
parameterTypes:
[Ljava.lang.Class;] length=1
[0]: (String) = "java.lang.String"
arguments:
[Ljava.lang.Object;] length=1
[0]: (String) = "admin_user"
All existing features preserved
Passive analysis, right-click context menu (Same/Any/Batch/Saved Rule), export (CSV/HTML/XML/Excel), and the swap engine all work exactly as before.