the-web-application-hackers-handbook

Chapter 5 n Bypassing Client-Side Controls 151
Attaching a Debugger
Decompilation is the most complete method of understanding and compromising
a browser extension. However, in large and complex components containing
tens of thousands of lines of code, it is nearly always much quicker to observe the
component during execution, correlating methods and classes with key actions
within the interface. This approach also avoids difficulties that may arise with
interpreting and recompiling obfuscated bytecode. Often, achieving a specific
objective is as simple as executing a key function and altering its behavior to
circumvent the controls implemented within the component.
Because the debugger is working at the bytecode level, it can be easily used
to control and understand the flow of execution. In particular, if source code
can be obtained through decompilation, breakpoints can be set on specific
lines of code, allowing the understanding gained through decompilation to be
supported by practical observation of the code path taken during execution.
Although efficient debuggers are not fully matured for all the browser extension
technologies, debugging is well supported for Java applets. By far the best
resource for this is JavaSnoop, a Java debugger that can integrate Jad to decompile
source code, trace variables through an application, and set breakpoints on
methods to view and modify parameters. Figure 5-6 shows JavaSnoop being
used to hook directly into a Java applet running in the browser. Figure 5-7
shows JavaSnoop being used to tamper with the return value from a method.
Figure 5-6: JavaSnoop can hook directly into an
applet running in the browser
NOTE It’s best to run JavaSnoop before the target applet is loaded.
JavaSnoop turns off the restrictions set by your Java security policy so that it
can operate on the target. In Windows, it does this by granting all permissions
to all Java programs on your system, so ensure that JavaSnoop shuts down
cleanly and that permissions are restored when you are finished working.
An alternative tool for debugging Java is JSwat, which is highly configurable.
In large projects containing many class files, it is sometimes preferable