Re: java app question
Jonathan Cran <[email protected]>
| Newsgroups | gmane.comp.security.web-applications,gmane.comp.security.penetration |
|---|---|
| Message-ID | <[email protected]> |
> i am looking to pen test an app which is not a webapp :) . on browsing to the url it launches a java application using jnlp. you'll probably want to take a look at the rash of java vulnerabilties that were released recently (see: full-disclosure). one that may be of particular use to you is the argument injection vulnerability that was included in metasploit: http://blog.metasploit.com/2010/04/java-web-start-argument-injection. Make sure this type (client-side) of attack is included in your threat model for the application, even if it isn't in-scope for the assessment. jcran -- Jonathan Cran [email protected] 515.890.0070 This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------