From the Ground Up
summary
Project marks every java.lang.String with an evil bit and propagates a tainted string flag via modified StringBuilder and an instrumented class loader. It uses Javassist bytecode manipulation to inject a boolean and stack-trace metadata into bootstrap classes, packages a jar prepended to the bootstrap classpath, and logs or throws when sinks like BufferedReader.readLine or java.sql.Statement.executeQuery are hit. Proof-of-concept passes unit tests and works for Groovy, Scala and Jython; JSPs still fail and the tool is not production-ready.
AI-written summary · about
chapters (20)
- 0:00Start
- 1:35Basic Idea
- 2:33Technologies
- 3:39ZAP policy
- 5:29Tracing
- 5:43WARNING
- 7:19Overview
- 7:43Building
- 8:04Preparing java.lang.String
- 9:53Wrapping method
- 10:14Actual wrapping
- 11:22POC - Setup
- 12:21Proofs on Concepts
- 14:45J2EE Test Case
- 15:33Output J2EE test
- 16:26Other JVM Languages
- 16:59From a JVM perspective
- 17:15Groovy
- 19:11Scala
- 20:20Jython
related talks
48mThe Hidden Security Hazards in Your Java Stack
46mPopular Approaches to Preventing Code Injection Attacks are Dangerously Wrong
53mHacking Java
45mMaking Java more dynamic
55mLiving in the Matrix with Bytecode Manipulation
43mDon't hack the JVM? ☠️💣💥
02h 38mJava application security the hard way - a workshop for the serious developer
48mHidden Security Features of the JVM - Everything You Didn’t Know and More