the-web-application-hackers-handbook

142 Chapter 5 n Bypassing Client-Side Controls
Working on the Source Code
Having obtained the source code for the component, or something resembling
it, you can take various approaches to attacking it. The first step generally is
to review the source code to understand how the component works and what
functionality it contains or references. Here are some items to look for:
n Input validation or other security-relevant logic and events that occur
on the client side
n Obfuscation or encryption routines being used to wrap user-supplied
data before it is sent to the server
n “Hidden” client-side functionality that is not visible in your user interface
but that you might be able to unlock by modifying the component
n References to server-side functionality that you have not previously identified
via your application mapping
Often, reviewing the source code uncovers some interesting functions
within the component that you want to modify or manipulate to identify
potential security vulnerabilities. This may include removing client-side
input validation, submitting nonstandard data to the server, manipulating
client-side state or events, or directly invoking functionality that is present
within the component.
You can modify the component’s behavior in several ways, as described in
the following sections.
Recompiling and Executing Within the Browser
You can modify the decompiled source code to change the component’s behavior,
recompile it to bytecode, and execute the modified component within your
browser. This approach is often preferred when you need to manipulate key
client-side events, such as the rolling of dice in a gaming application.
To perform the recompilation, you need to use the developer tools that are
relevant to the technology you are using:
n For Java, use the javac program in the JDK to recompile your modified
source code.
n For Flash, you can use flasm to reassemble your modified bytecode or
one of the Flash development studios from Adobe to recompile modified
ActionScript source code.
n For Silverlight, use Visual Studio to recompile your modified source code.
Having recompiled your source code into one or more bytecode files, you
may need to repackage the distributable file if required for the technology
being used. For Java and Silverlight, replace the modified bytecode files in your