a1phaboy/FastjsonScan

Health v2 · maintenance only

Adoption not part of the score

1055 stars · 94 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

FastjsonScan is a Go-based command-line scanner that detects Fastjson deserialization vulnerabilities in Java web services. It identifies the Fastjson version, AutoType status, and dependency libraries through error-based, DNS, and delay-based probing techniques.

Use cases

• detect fastjson deserialization vulnerabilities in a web app
• identify fastjson version of a target endpoint
• check if autotype is enabled on a java service
• batch scan a list of urls for fastjson rce
• detect dependency libraries via dnslog probing
• find fastjson versions vulnerable to rce

When to choose

• you need an actively maintained fastjson scanner covering versions up to 1.2.83
• you want batch URL scanning with error, DNS, and delay detection
• you need AutoType status and dependency library detection in one tool

When to avoid

• you need to scan JSON libraries other than fastjson, jackson, gson, or org.json
• you require automated exploitation rather than detection
• you need scanning in restricted intranet environments without DNS egress

Facets

cli-tool · maturity maintenance

vulnerability-scanning security http-client cli security penetration-testing developer-tools windows cli go fastjson deserialization-vulnerability java-security scanner pentest linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="a1phaboy/FastjsonScan")