• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
  • Campbell Ritchie
  • Ron McLeod
  • Paul Clapham
  • Bear Bibeault
  • Junilu Lacar
  • Jeanne Boyarsky
  • Tim Cooke
  • Henry Wong
Saloon Keepers:
  • Tim Moores
  • Stephan van Hulst
  • Tim Holloway
  • salvin francis
  • Frits Walraven
  • Scott Selikoff
  • Piet Souris
  • Carey Brown

GWT-RPC: hacked attempt on request payload.

Posts: 1
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
My test team try to hack on the system, they found out that GWT-RPC call returned a sensitive information (class name as emphasis as below) in response format "//EX" message. I'm amazed that I can't find any postings on this issue.

HTTP Request (Request payload):


HTTP Response:

//EX[2,1,["com.google.gwt.user.client.rpc.IncompatibleRemoteServiceException/3936916533","This application is out of date, please click the refresh button on your browser. ( Blocked attempt to access
interface 'abc', which is not implemented by 'com.testProject.client.customerClassService'; this is either misconfiguration or a hack attempt)"],0,7]

Specially the part that says "either misconfiguration or a hack attempt". In my case is hack attempt as HTTP Response, because the exception states that 'abc' is not implemented by 'com.testProject.client.customerClassService'.

Any ideas to hide the sensitive information (class name) in the error message as above ? I try with all browsers available it is not from the browser.

Urgent. Any help will be appreciated.
Don't get me started about those stupid light bulbs.
    Bookmark Topic Watch Topic
  • New Topic