JavaSnoop: How to hack anything written in Java - Revision history

Arshan: /* The presentation */

2010-10-07T19:10:27Z

‎The presentation

Dallendoug: added link header

2010-09-21T04:58:56Z

added link header

Mark.bristow: Created page with '== The presentation == rightAnybody who has assessed anything with a thick Java client has probably been frustrated beyond belief and unhappy wi…'

2010-09-16T22:42:24Z

Created page with '== The presentation == rightAnybody who has assessed anything with a thick Java client has probably been frustrated beyond belief and unhappy wi…'

New page

== The presentation ==

[[Image:Owasp_logo_normal.jpg|right]]Anybody who has assessed anything with a thick Java client has probably been frustrated beyond belief and unhappy with their coverage, but that's only because this tool hasn't been released yet. We created a tool that allows you to easily jump into any JVM on your machine, and tamper with class bytecode, method parameters, return values - without requiring any pesky original source code, or the most elusive artifact - skill!

What happens when that applet you want to hack uses serialized objects over a custom encryption scheme, and you have 40 hours to break it? Theoretically, you know that's not good enough, but who cares about "theoretically"? JavaSnoop will allow you to intercept calls inside the JVM for tampering with data before it gets to the network, while its still in object form! What happens when that fancy desktop tool you have has an expired license? JavaSnoop will allow you to make that isLicensed() check return the value you want, instead of the value you didn't pay for.

All this in a nice, portable GUI tool. I can't wait to enable you!

== The speaker ==

Speaker bio will be posted shortly.

[[Category:AppSec_DC_2010_Presentations]] [[Category:OWASP_Conference_Presentations]]

@@ Line 1: / Line 1: @@
 == The presentation  ==
 [[Image:Owasp_logo_normal.jpg|right]]Anybody who has assessed anything with a thick Java client has probably been frustrated beyond belief and unhappy with their coverage, but that&apos;s only because this tool hasn&apos;t been released yet. We created a tool that allows you to easily jump into any JVM on your machine, and tamper with class bytecode, method parameters, return values - without requiring any pesky original source code, or the most elusive artifact - skill!
-What happens when that applet you want to hack uses serialized objects over a custom encryption scheme, and you have 40 hours to break it? Theoretically, you know that&apos;s not good enough, but who cares about "theoretically"? JavaSnoop will allow you to intercept calls inside the JVM for tampering with data before it gets to the network, while its still in object form! What happens when that fancy desktop tool you have has an expired license? JavaSnoop will allow you to make that isLicensed() check return the value you want, instead of the value you didn&apos;t pay for.
+What happens when that applet you want to hack uses serialized objects over a custom encryption scheme, and you have 40 hours to break it? Theoretically, you know that&apos;s not good enough, but who cares about "theoretically"? JavaSnoop will allow you to intercept calls inside the JVM for tampering with data before it gets to the network, while its still in object form! What happens when that fancy desktop tool you have has an expired license? JavaSnoop will allow you to make that isLicensed() check return the value you want, instead of the value you didn't pay for.
-All this in a nice, portable GUI tool. I can&apos;t wait to enable you!
+All this in a nice, portable GUI tool. I can't wait to enable you!
 == The speaker  ==