The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

when the data they capture is obfuscated in some manner before being

transmitted to the server. In this situation, modifying the submitted values 

will typically break the obfuscation and so will be rejected by the server. 

To circumvent the validation, it is necessary to look inside the thick-client

component itself, understand the validation and obfuscation it performs, 

and subvert its processing in some way so as to achieve your objective.

Java Applets

Java applets are a popular choice of technology for implementing thick-client

components because they are cross-platform and they run in a sandboxed

environment which mitigates against various kinds of security problems that

can afflict more heavyweight thick-client technologies.

As a result of running in a sandbox, Java applets cannot normally access

operating system resources such as the file system. Hence, their main use as a

client-side control is to capture user input or other in-browser information.

Consider the following extract of HTML source, which loads a Java applet con-

taining a game:

Enter name:

id=”TheApplet”>

In this code, the applet tag instructs the browser to load a Java applet from

the specified URL and instantiate it with the name 

TheApplet

. When the user

clicks the Play button, a JavaScript routine executes that invokes the 

getScore

method of the applet. This is when the actual game play takes place, after which

the score is displayed in an alert dialog. The script then invokes the 

getObsScore

method of the applet, and submits the returned value as a parameter to the

submitScore.jsp

URL, together with the name entered by the user.