search

federicodotta / Java-Deserialization-Scanner

All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities
776 stars 177 forks source link

ASCII hex generating false positives #2

Open anantshri opened 8 years ago

anantshri commented 8 years ago

ascii hex magic selected for detection translates to "aced" in ASCII which could be very well be a variable name or portion of text in variable. example variable name placed would be detected as serialized object.

not sure how to tackle it

federicodotta commented 8 years ago

Hi anantshri, thank you for the issue. I leave this issue open and I will try to add some other specific characters of serialized Java objects in order to decrease the possibility for false positives.