# pmiaowu/BurpFastJsonScan

一款基于BurpSuite的被动式FastJson检测插件

Repository: https://github.com/pmiaowu/BurpFastJsonScan
Canonical: https://ross.abutalabs.com/products/burpfastjsonscan
Language: Java
License Family: other
Last push: 2022-10-01T05:17:07+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2088, "days_push": 1432, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1251, forks 129 (observed 2026-08-28T04:04:08.239680+00:00)

## What it is
A passive BurpSuite extension written in Java that detects FastJson deserialization vulnerabilities in JSON-bearing HTTP requests. It automatically scans GET, POST, and Cookie parameters containing JSON and reports command execution findings via Tag, Extender, and Scanner issue views.

## Use cases
- detect fastjson deserialization vulnerabilities in web apps
- passively scan burp traffic for fastjson rce
- find json deserialization command execution during pentests
- burp suite plugin for fastjson detection
- test json parameters for fastjson exploits

## When to choose
- you are doing authorized penetration testing on Java services that may use FastJson
- you want passive detection of FastJson RCE while browsing a target through BurpSuite
- you need command echo or DNS-based out-of-band confirmation of FastJson vulnerabilities

## When to avoid
- you need active scanning outside of BurpSuite
- your Burp 2.x runs on a newer JDK and you cannot recompile the plugin yourself
- you are looking for general-purpose web vulnerability scanning beyond FastJson

## Facets
- artifact type: plugin
- maturity: maintenance
- function: security, vulnerability-scanning, penetration-testing, parser
- domain: security, penetration-testing, developer-tools
- platform: jvm
- tags: burpsuite-extension, fastjson, deserialization, rce-detection, passive-scanning, security-testing, desktop

## Member repositories
- pmiaowu/BurpFastJsonScan (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:08.239680+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:07:41.228156+00:00, confidence not recorded.
  - readme: https://github.com/pmiaowu/BurpFastJsonScan (fetched 2026-08-28T04:04:08.239680+00:00, sha 945bb41bc0f0)
- Data as of 2026-08-30T08:39:29.467469+00:00.