Burp suite scanner how to#
Burp suite scanner manual#
Burp suite scanner code#

This tab uses the ysoserial tool to generate exploitation vectors and includes the generated payload in a HTTP request. The “Exploiting” tab offers a comfortable interface to exploit deserialization vulnerabilities. ExploiterĪfter that a Java deserialization vulnerability has been found, it is possible to actively exploit the issue with the Exploiting dedicated tab. The CPU detection method is not included by default in the active scan checks, because it must be used with caution: sending a huge number of “light” SerialDOS payloads may still cause problems on old or highly-loaded systems. The CPU detection method is based on Wouter Coekaerts’ SerialDOS work ( ) and it is able to detect deserialization issues without the presence of any vulnerable library, using an object that employs many CPU cycles for the deserialization task and checking the time of the response.

Burp suite scanner manual#

The manual tester offers an extra detection method: CPU detection. The results of the manual tester can be inserted between Burp Suite scanner results. The plugin offer a dedicated tab to launch the detection with the sleep and DNS payloads on custom insertion points, in order to check the Java deserialization vulnerabilities in particular situations in which strange entry points do not allow the detection with the scanner. Every application employ a different vulnerable Java library. In the test folder there are some simple Java server applications that can be used to test the plugin.

Refer to this link for more details.Īll the components of the plugin supports the following encodings:

Burp suite scanner code#

If the plugin find only the URLDNS issue (and no vulnerable libraries), the attacker probably can execute DoS attacks but to achieve Remote Code Execution it is necessary more effort.

Java 8 (up to Jdk8u20) without any weak libraryįurthermore, URLSNDS payload has been introduced to actively detect Java deserialization without any vulnerable libraris.

Java 6 and Java 7 (up to Jdk7u21) without any weak library.

Spring (up to 4.2.2), with two different chains.

Apache Commons Collections 4 (up to 4.4.0), with two different chains.

Apache Commons Collections 3 (up to 3.2.1), with five different chains.

Payloads that execute a DNS resolution, in order to verify the presence of the issue using the Burp Suite Collaborator integrated in Burp SuiteĬurrently, the passive checks of the Java Deserialiation Scanner reported the presence of serialized Java objects in the HTTP requests and the active checks actively scan for the presence of weak deserialization functions in conjuction with the presence of the following weak libraries:.

Payloads that execute a syncronous sleep function, in order to verify the presence of the issue depending on the time of the response.

For this reason, a modified version of ysoserial is used to generate different types of payloads, usefull for the detection of the issue instead of the exploitation: Usually, however, it is not possible to see the output of the command and consequently it is not simple to write a scanner based on this kind of function. The original tool ( ) generate payloads for the execution of commands on the system, using the Runtime.exec function. Java Deserialization Scanner uses custom payloads generated with a modified version of 'ysoserial', tool created by frohoff and gebl, to detect Java deserialization vulnerabilities. Integration with Burp Suite active and passive scanner

Burp suite scanner how to#

Federico Dotta, Principal Security Analyst at HN SecurityĪ brief article containing a mini walkthrough on how to use the various components of the plugin can be found at the following URL:.

Exploiter, that allow to actively exploit Java deserialization vulnerabilies, using frohoff ysoserial ( ).

Manual tester, for the detection of Java deserialization vulnerabilities on custom insertion points.

Integration with Burp Suite active and passive scanner.

The plugin is made up of three different components:

It was written by Federico Dotta, Principal Security Analyst at HN Security. Java Deserialization Scanner is a Burp Suite plugin aimed at detect and exploit Java deserialization vulnerabilities.