pmiaowu/BurpFastJsonScan

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1251 stars · 129 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A passive BurpSuite extension written in Java that detects FastJson deserialization vulnerabilities in JSON-bearing HTTP requests. It automatically scans GET, POST, and Cookie parameters containing JSON and reports command execution findings via Tag, Extender, and Scanner issue views.

Use cases

• detect fastjson deserialization vulnerabilities in web apps
• passively scan burp traffic for fastjson rce
• find json deserialization command execution during pentests
• burp suite plugin for fastjson detection
• test json parameters for fastjson exploits

When to choose

• you are doing authorized penetration testing on Java services that may use FastJson
• you want passive detection of FastJson RCE while browsing a target through BurpSuite
• you need command echo or DNS-based out-of-band confirmation of FastJson vulnerabilities

When to avoid

• you need active scanning outside of BurpSuite
• your Burp 2.x runs on a newer JDK and you cannot recompile the plugin yourself
• you are looking for general-purpose web vulnerability scanning beyond FastJson

Facets

plugin · maturity maintenance

security vulnerability-scanning penetration-testing parser security penetration-testing developer-tools jvm burpsuite-extension fastjson deserialization rce-detection passive-scanning security-testing desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="pmiaowu/BurpFastJsonScan")