I'm pentesting a JNLP application composed by several .jar files. I'm able to decompile with jd-gui every 3rd party library included in it, but the main .jar coded by my client.
So after running JD-Gui, Krakatau, procyon decompiler and other well known and I always receive the same response: "Not a valid zip file".
My first thought it was this JAR being obfuscated, however when I extract the strings with "strings target.jar" I can successfully see lots of hardcoded strings including class names, SQL queries, contact details (email address and such), and others. Which makes me doubt if this Jar file is actually obfuscated or not.
On a side note, something that bring my attention was that every library within this JNLP application contains the file: NameOfClient.RSA within the META-INF folder. So I'm guessing this Jar files are signed somehow with a private signature but I'm not sure if this has anything to do with what I'm struggling right now.
My questions: If I can read strings in plain text this means the JAR is not obfuscated? How would you proceed on this case?
Thanks
stringsfinds stuff from the class files, the jar seems to be neither compressed nor encrypted. I'd assume they violated the zip format in some way, like a file name that consists of '\0' bytes only, and would rename the file to .zip, and try various unpackers (7zip, unzip, winrar, ..) to unpack it. Remember a jar is nothing but a zip with a different extension. – Guntram Blohm Oct 23 '15 at 22:04