Re: Corsaire White Paper: Assessing Java Clients with the BeanShell

["Matthew Franz" <mdfranz () gmail com>]

Very cool article, but since BeanShell is basically Java (and Java is
a horrible scripting language for a whole lot of obvious reasons) IMHO
this sort of mayhem is better conducted in something like JRuby or
Jython or even Groovy ( http://groovy.codehaus.org/) if one doesn't
already know with Ruby or Python.

All of Java Scripting languages should provide the same sort of
functionality in terms of inspecting objects, embedding interpreters,
etc.

- mdf

On 8/18/06, Stephen de Vries <stephen () corsaire com> wrote:
> http://www.corsaire.com/white-papers/060816-assessing-java-clients-
> with-the-beanshell.pdf
> Assessing the security of Java applications, and particularly client-
> server applications, can be a tedious process of modifying the code,
> compiling, deploying, testing and repeat. This becomes even more
> difficult when the source code to the application is not available.
> What security testers require is an easy means of interacting with
> the internals of a Java application during execution without
> recompiling the code.
>
> The BeanShell (http://www.beanshell.org) provides an interpreted,
> scripting environment that can plug in to any Java application or
> applet and allows users to inspect and manipulate objects
> dynamically. This paper demonstrates a technique for using the
> BeanShell to assess the security of a typical Java client-server
> application.
>
>
>
> --
> Stephen de Vries
> Corsaire Ltd
> E-mail: stephen () corsaire com
> Tel:    +44 1483 226014
> Fax:    +44 1483 226068
> Web:    http://www.corsaire.com
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> Watchfire was recently named the worldwide market leader in Web
> application security assessment tools by both Gartner and IDC.
> Download a free trial of AppScan today and see why more customers choose
> AppScan then any other solution. Try it today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
> --------------------------------------------------------------------------



--
Matthew Franz
http://www.threatmind.net/

-------------------------------------------------------------------------
Sponsored by: Watchfire

Watchfire was recently named the worldwide market leader in Web 
application security assessment tools by both Gartner and IDC. 
Download a free trial of AppScan today and see why more customers choose 
AppScan then any other solution. Try it today!
 
https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB
--------------------------------------------------------------------------