Wouter Coekaerts (@WouterCoekaerts) profile picture

Wouter Coekaerts

@WouterCoekaerts

Programming puzzles and security enthousiast. ex-@Square . @wouterc@mastodon.online

 Belgium
wouter.coekaerts.be/
Joined October 2010
  • Tweets226
  • Following195
  • Followers530
5Media
Photo by Wouter Coekaerts (@WouterCoekaerts)Photo by Wouter Coekaerts (@WouterCoekaerts)Photo by Wouter Coekaerts (@WouterCoekaerts)Photo by Wouter Coekaerts (@WouterCoekaerts)
Did you know you can call JNI without writing native code, patch bytecode without an agent, and use Unsafe without warnings? 11 sneaky ways into JDK internals through reflection, agents, FFM, type confusion, bytecode manipulation and more. wouter.coekaerts.be/2026/dec…

Decapsulation: Breaking Java Strong Encapsulation

Did you know you can call JNI without writing native code, patch bytecode without an agent, and use Unsafe without warnings? 11 sneaky ways into JDK internals through reflection, agents, FFM, type...

wouter.coekaerts.be
5
1
12
1,097
I'm excited to announce FlowTracker, a Java agent that tracks data flowing through Java programs. It helps you understand where any program got its output from, what it means, and why it wrote it. Watch the video, explore the live demo and read more at github.com/coekie/flowtracke…
GitHub - coekie/flowtracker: Track data flowing through Java programs

GitHub - coekie/flowtracker: Track data flowing through Java programs

Track data flowing through Java programs. Contribute to coekie/flowtracker development by creating an account on GitHub.

github.com
5
5
893
The hacker spirit breaks any spell.
Image from Simone Margaritelli (@evilsocket)
3
38
1
138
14,035
I just added solutions to the non-empty empty String challenge. A simple one, but also two original solutions, including one that does not even use any concurrency!
2
6
2,251
Abusing a bug in java.lang.String to make "hello world" not start with "hello". Plus a challenge: make an empty String that is not equal to "". wouter.coekaerts.be/2023/bre…

Breaking java.lang.String

Let's abuse a bug in java.lang.String

wouter.coekaerts.be
7
47
4
171
24,835
I just added solutions to the non-empty empty String challenge. A simple one, but also two original solutions, including one that does not even use any concurrency!
2
6
2,251
Your Downloads folder is like that box of old cables you don't want to throw away. Hundreds or even thousands of cables. Some of them pretty questionable.
SwiftOnSecurity (@SwiftOnSecurity) profile pictureSwiftOnSecurity
@SwiftOnSecurity17 Mar 2022
*Jesus sees your Downloads folder that has everything since 2012, which you move between computers* "Bro what the fuck is this"
2
Now that another string formatting DoS vulnerability in java (CVE-2021-45105) is in the news, a reminder: Passing user input into the format for String.format also makes you vulnerable to a DoS.
Wouter Coekaerts (@WouterCoekaerts) profile pictureWouter Coekaerts@WouterCoekaerts18 Mar 2021
You can say that format string vulnerabilities are not a thing in Java, but String.format("%2147483647%") is not your friend.
1
copilot.github.com now shows me sentiment.ts as the first example, which is not better. It adds a "urlencoded" header, but it's not actually url encoded. What if `text` contains a `&`? You might even call that a security vulnerability.
Image from Wouter Coekaerts (@WouterCoekaerts)
1
13
3
85
Wouter Coekaerts retweeted
Tagir Valeev (@tagir_valeev) profile picture
Tagir Valeev
@tagir_valeev8 Jun 2021
Ok, #Java folks, here's a puzzle for you. Replace '...' in this code with proper Java expressions so that the first println prints 'true' and the second one prints 'false' when running on Java 16.
Image from Tagir Valeev (@tagir_valeev)
8
7
2
69
You can say that format string vulnerabilities are not a thing in Java, but String.format("%2147483647%") is not your friend.
1
8
2
29
Explanation: it tries to create a String of length Integer.MAX_VALUE, that is 2GB. To make it succeed (assuming your heap size is big enough), pick a slightly smaller size.
1
1
if you're using errorprone that doesn't even compile because it makes errorprone throw an OutOfMemoryError while validating the format string.
2
2
Replying to @FredTaming
Wife: Please go to the store to buy some scissors, and if they have eggs, get 3. ... Store clerk: Hey! You break it, you buy it!
4
44
Choosing a new internet provider. Should I go for @proximus, selling me a 100Mbps connection as 100MB/s (through their partner totaalplan)? Or @orange, offering a plan for 7973,55 €/month (due to broken css)?
Image from Wouter Coekaerts (@WouterCoekaerts)
Image from Wouter Coekaerts (@WouterCoekaerts)
2
6
That's "<span class="hidden-soho">79</span><span class="hidden-res">73,55</span> €" on orange.be/nl/producten-en-di… , offering this extra special deal to Chrome users.
1
Wouter Coekaerts retweeted
Tagir Valeev (@tagir_valeev) profile picture
Tagir Valeev
@tagir_valeev18 Sep 2019
A puzzle: provide a Java code sample where replacing explicit `java.lang.Object` local variable type with `var` breaks the program at runtime without breaking the compilation.
11
3
1
18
Two solutions to the challenge, including some explanation: wouter.coekaerts.be/2019/puz…
2
2
2
Java challenge: Write Hello World without using a dot, backslash, or semicolon
Image from Wouter Coekaerts (@WouterCoekaerts)
7
7
1
28
more replies
Clarification 2: Follow the example of the screenshot, and common sense(?). A syntax error probably does not look like just "Hello World".
1
Two solutions to the challenge, including some explanation: wouter.coekaerts.be/2019/puz…
2
2
2
Load more