Tagged Questions
9
votes
1answer
585 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
9
votes
1answer
700 views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if ...
4
votes
2answers
289 views
Class.forName injection and constructor invocation
If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter)
What's the worst possible consequence?
The attacker does obtain stack traces. After ...
