Re: java app question

[Jonathan Cran <jcran () 0x0e org>]

> i am looking to pen test an app which is not a webapp :) . on browsing to the url it launches a java application 
> using jnlp.

you'll probably want to take a look at the rash of java vulnerabilties
that were released recently (see: full-disclosure). one that may be of
particular use to you is the argument injection vulnerability that was
included in metasploit:
http://blog.metasploit.com/2010/04/java-web-start-argument-injection.

Make sure this type (client-side) of attack is included in your threat
model for the application, even if it isn't in-scope for the
assessment.

jcran

-- 
Jonathan Cran
jcran () 0x0e org
515.890.0070

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------