The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 5 

■

Bypassing Client-Side Controls

123

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 123

---

you can achieve the same effect using the debugging or instrumentation tech-

niques described previously, to fix the data returned to the control by the rele-

vant file system or registry APIs.

Decompiling Managed Code

Occasionally, you may encounter thick-client components written in C#. As

with Java applets, these can normally be decompiled to recover the original

source code.

A useful tool for performing this task is .NET Reflector by Lutz Roeder (see

Figure 5-9).

Figure 5-9:  The .NET Reflector tool being used to decompile an 

ActiveX control written in C#

Similar code obfuscation issues can arise in relation to C# assemblies as arise

with Java bytecode.