Method Piercing in Java
There’s nothing new here. I just want to reiterate though.
class TargetClass {
private static String DB_PASSWORD = "sw0rdfish";
private static String getDatabasePassword() {
return DB_PASSWORD;
}
}
And the attack?
import java.lang.reflect.Method;
public class ClassPiercing {
public static void main(String... args) throws Exception {
Class targetClass = Class.forName("TargetClass");
Method[] methods = targetClass.getDeclaredMethods();
methods[0].setAccessible(true);
String databasePassword = (String)methods[0].invoke(null, null);
System.out.println("Database Password: " + databasePassword);
}
}
Output:
Database Password: sw0rdfish
Check out Val’s Blog by clicking [here]. He has more examples.
Hahaha that’s pretty lame
Comment by numerodix — February 13, 2009 @ 3:10 am
Yeah, use your creativity
Comment by Joset Anthony Zamora — February 13, 2009 @ 6:49 am