Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google etc. yields nothing. Any hints on how to attack RAP are highly appreciated.


The application under consideration is remote; there's no way to observe the internal processing of application. All I can see is the exchange of messages as defined by the RAP protocol.


RCP and RAP applications are typically built using the Eclipse E4 Tool package. There may be test cases unique to the target underlying operating system -- Eclipse runs on OS X, Linux, Windows, and a few other OSes. First, get the Delta Pack -- http://download.eclipse.org/eclipse/downloads/drops4/R-4.4.2-201502041700/#DeltaPack

The Delta Pack contains all the platform specific resources from the SDK and is used for cross-platform exports of RCP applications. If you know how to install new software to Eclipse ("Help", "Install New Software", "Add"), then put the following into the Location field:


After you have a stable platform and know how to create and modify RCP and RAP applications using E4 and the surrounding technology tooltips, you are on the way to know how to pentest these apps. Many will affect Eclipse only and few will call out to a file on the operating system or a network. If they do, you can leverage many existing Java-friendly pen-test tools such as Javasnoop, JDB, JSwat, DSer, untidy (for XML), et al.

The closest thing I can find to a RAP application would be something like Oracle Forms. Here is a blog post describing three ways to target an Oracle Forms app that uses HTTP or TLS. The blog does recommend Javasnoop for other more-flexible tasks. Here are additional use cases for Javasnoop:

For the non-Java portions of a RAP pen test, such as Javascript, you may want to look at retire.js (a tool similar to OWASP Dependency Check that can be used to analyze third-party Javascript components for well-known vulnerabilities) or Fortify SCA (a good securtiy-focsued static-analysis engine that works on Javascript code).

  • Thanks for taking the time to answer. Unfortunately your answer doesn't help me in my use/test case. The application is remote and I've no way (modulo finding and exploiting suitable vulnerabilities) to access the application except through the provided interface. All I can see is the exchange of JSON strings. – countermode Mar 24 '15 at 10:28
  • retire.js and Burp Suite Professional may be your best bets then – atdre Mar 24 '15 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.