Airman
1 min readJan 14, 2019

--

Just to clarify, code execution can be achieved regardless of the name of the JDBC driver class as all registered JDBC drivers are tried by default upon a connection attempt. Naming the “backdoor” driver class similar to a legitimate JDBC driver only serves a purpose of bypassing any application-specific checks.

Renaming the “backdoor” driver class is trivial, keep in mind to rename the source file and folders accordingly (i.e. a class named com.something.blah.Blah should be in com/something/blah/BLAH.java file).

--

--

Airman
Airman

Written by Airman

Random rumblings about #InfoSec. The opinions expressed here are my own and not necessarily those of my employer.

No responses yet