The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

options. A useful obfuscator to use here is Jode, which can remove

redundant code paths added by another obfuscator, and facilitate the

process of understanding obfuscated names by assigning globally unique

names to items.

ActiveX Controls

ActiveX controls are a much more heavyweight technology than Java applets.

They are effectively native Win32 executables that, once accepted and installed

by the user, execute with the full privileges of that user and can carry out arbi-

trary actions, including interacting with the operating system.

ActiveX can be used to implement practically any client-side control,

including capturing user input and other in-browser data, and verifying that

the client computer meets certain security standards before allowing access to

some function.

From the point of view of HTML page source, ActiveX controls are instanti-

ated and invoked in a very similar way to Java applets. For example, if you