Java Applets speaking to Java Servlets: Communication Testing

By Johnny Yu ·

I was previously on an engagement where I needed to review a web application composed of Java Applets that speak to Java Servlets. While Burp Suite does an excellent job at intercepting HTTP traffic and allowing me to manipulate the content, it was difficult to make intelligent changes to the information because it was in a serialized Java format. 

Figure 1: Serialized Java Data Request

Figure 2: Serialized Java data Response

A bit of Googling led me to a buby script called DSer by Manish S. from Attack & Defense Lab (http://blog.andlabs.org which can deserialize Java Object so an assessor can make alterations to it before submitting the data. The existing implementation of the script only supports editing Java Object through an IRB shell. At first this was acceptable, but as I began to encounter requests and responses that have many child objects, it became very time-consuming and difficult to manage. The author of DSer had a follow-up post on revisiting Java deserialization (http://blog.andlabs.org/2010/09/re-visiting-java-de-serialization-it.html), where he introduced the idea of converting Java Object into XML and editing it through that format. This approach is definitely cleaner as the assessor can clearly see the structure of the objects and evaluate which elements or attributes deserve manipulation. Manish suggested using the XStream library, which can perform the transition between Java Object and XML. Unfortunately, Manish did not publish his newest code, so I decided to spend some time to enhance the existing DSer script to support XML editing using the XStream library through a GUI. The implementation is pretty straightforward, and the result is rewarding because I can complete my engagement within time.

Here are some screenshots of the XML Java editing in action:

Figure 2: intercepting serialized Java Request

Figure 3: Intercepting serialized Java Response

With Manish’s blessing, I am sharing this updated version of DSer with folks that may run into the same situation as I did.

Happy Testing!