2

I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.

So after running JD-Gui, Krakatau, procyon decompiler and other well known and I always receive the same response: "Not a valid zip file".

My first thought it was this JAR being obfuscated, however when I extract the strings with "strings target.jar" I can successfully see lots of hardcoded strings including class names, SQL queries, contact details (email address and such), and others. Which makes me doubt if this Jar file is actually obfuscated or not.

On a side note, something that bring my attention was that every library within this JNLP application contains the file: NameOfClient.RSA within the META-INF folder. So I'm guessing this Jar files are signed somehow with a private signature but I'm not sure if this has anything to do with what I'm struggling right now.

My questions: If I can read strings in plain text this means the JAR is not obfuscated? How would you proceed on this case?

Thanks

2
  • 3
    Signing the .jar will insert a something.rsa file into META-INF, but it shouldn't invalidate the zip itself. And as strings finds stuff from the class files, the jar seems to be neither compressed nor encrypted. I'd assume they violated the zip format in some way, like a file name that consists of '\0' bytes only, and would rename the file to .zip, and try various unpackers (7zip, unzip, winrar, ..) to unpack it. Remember a jar is nothing but a zip with a different extension. – Guntram Blohm Oct 23 '15 at 22:04
  • did you find any solution for that? – Mohammad Hossein Amri Jul 20 '19 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.