Anybody who has assessed anything with a thick Java client has probably been frustrated beyond belief and unhappy with their coverage, but that's only because this tool hasn't been released yet. We created a tool that allows you to easily jump into any JVM on your machine, and tamper with class bytecode, method parameters, return values - without requiring any pesky original source code, or the most elusive artifact - skill! What happens when that applet you want to hack uses serialized objects over a custom encryption scheme, and you have 40 hours to break it? Theoretically, you know that's not good enough, but who cares about "theoretically"? JavaSnoop will allow you to intercept calls inside the JVM for tampering with data before it gets to the network, while its still in object form! What happens when that fancy desktop tool you have has an expired license? JavaSnoop will allow you to make that isLicensed() check return the value you want, instead of the value you didn't pay for. All this in a nice, portable GUI tool. I can't wait to enable you!
Aspect Security Arshan Dabirsiaghi is the Director of Research at Aspect Security, a company that specializes in a range of application security services. He's found vulnerabilities in big, popular software, discovered new attack techniques, spoken at big conferences, and blah, blah, blah. Really, he just left PR hack on AOL yesterday and spends most of his research time finding bugs that Sami Koivu found months or years ago.