can you? for example https://buildsecurityin.us-cert.gov/daisy/bsi/search?query=asdf%27e%22e%3Ee%3Ce

is there a way to inject into java to inject arbitrary commands or to smash the stack. i don't know enough about java, so an example if so would be nice ^^

-maluc

You can have a command injection for Java here:
http://samate.nist.gov/SRD/?1596

But for the stack, you only (I guess) have to make Java performing a infinite loop...

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

Specificly JAVA? or JAVA that is using SQL to query a DB?
i don't like JAVA, but sure, buffer overflow is pretty easy (as in every (c based) language). still it relies on the protection of the language itself, so there's nothing you could do about that issue. Like in certain functions in PHP which are easy to force with alot of data thrown into, says more about the language itself and it's functions.

i don't know JAVA in depth to give any example.