The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

118

Chapter 5 

■

Bypassing Client-Side Controls

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 118

---

of execution is hard to discern when reading through the decompiled

source.

■■

Illegal programming constructs may be introduced, such as unreach-

able statements, and code paths with missing return statements. Most

JVMs will tolerate these phenomena in bytecode, but the decompiled

source cannot be recompiled without correcting the illegal code.

HACK STEPS

Effective tactics for coping with bytecode obfuscation depend upon the

techniques used and the purpose for which you are analyzing the source. Here

are some suggestions:

■

You can review an applet for public methods without fully understanding