6

What is a quick method to know if a website uses Java (e.g. in a Java applet).

One way would be to scan the source code of the page for clues, but I am looking for a quicker way. If possible, not a method that relies on a browser extension.

(I use Firefox, but hints for other browsers are welcome as well.)

PS: I am not interested in blocking Java or similar. I am just looking for a quick (but correct) indication if a page uses Java.

Improve this question
4
  • 2
    What exactly are you trying to accomplish? Do you simply want to avoid browsing to a site that integrates applets?
    – innaM
    Nov 16, 2009 at 8:56
  • @Manni: My question is rather generic. I was trying to help a friend who reports that his Firefox crashes on certain sites. I /thought/ this might be because both sites used Java. While pondering upon this, it occurred to me that I didn't know how to quickly check if a sites uses Java or not. I thought there would be info on the Media tab of the 'Page Info' dialog of Firefox, but there is not.
    – Rabarberski
    Nov 16, 2009 at 9:37
  • @Rabarberski, It might be more useful list the sites which crash firefox in this case.
    – nik
    Nov 16, 2009 at 13:27
  • @nik: thanks for the suggestion, but with this question I am not trying to fix the crashing problem. I am genuinely interested in 'how to see if a site uses Java'. (the user apparently had other browser problems as well, so I advised a complete erase and reinstall of firefox)
    – Rabarberski
    Nov 16, 2009 at 14:06

6 Answers 6

Reset to default
5

If there is a Java applet embedded, you would typically have references to '.class' files on the page.

If you use the firefox addon NoScript Java launch will be blocked.
If they get blocked, you can make NoScript permit execution of the scripts that launch the applet
(typically with the status bar icon alt text)

If you have also installed the Adblock Plus addon, clicking on its Icon (AdBlock Plus) in the Firefox menu will open a blockable items window in the browser. This will show all the class files that are allowed.

You can again explicitly block specific Java applets here.

Update: You can limit to just the AdBlock Plus addon and click on the red icon to see if there are any java files linked.

Further on your comment in the question.

  • do they see another browser also crash similarly for the same sites? (IE, Chrome)
  • have you tried for the negative-case where a Java based site does-not crash the firefox?
  • does this firefox in question have many other extensions installed (maybe, experimental ones)?

Update2: on your secondary comments.
If its detection of Java that interests you. Installing just the AdBlock Plus addon should suffice. You could always just open the "blockable items on current page" while on the site and type "class" in the Search bar there.

Improve this answer
1
  • Thanks for your troubleshooting tips, but see my 2nd comment to my question
    – Rabarberski
    Nov 16, 2009 at 14:07
1

There is really no way to know this a before displaying the page.

And even then, if the author of the page made an effort to hide it, there would be no external indication to its presence. Hidden Java applets are one of the vectors of propagation for viruses, and are therefore not advised. A Java applet doesn't have to terminate when the displayed page is changed, and can continue to work in the background.

As already mentioned here, the only real protection against hidden applets is utilities such as NoScript or Adblock, that scan the source and eradicate them before they are executed by the browser.

Improve this answer
8
  • 1
    A signed applet has full access to the local file system, and digital certificates are known to have falsely been acquired for well-known websites thru non-prudent resellers. I've written Java applets, and so I Know enough not to let any applet execute except if I absolutely have to, and I normally restart Firefox afterward.
    – harrymc
    Nov 16, 2009 at 10:33
  • 2
    @harrymc: In theory you're right, but there are very few cases where digital certs have been falsely acquired (and even in that case the cert can be revoked); additionally, the browser will still prompt you if an applet wants to elevate privileges, even with a valid cert. So I don't believe Java applets are such a huge security risk; the security architecture is actually fairly decent.
    – sleske
    Nov 16, 2009 at 11:41
  • 1
    @harrymc: And I've never heard of a virus distributed by a Java applet. I'd be interested in any references for that.
    – sleske
    Nov 16, 2009 at 11:42
  • 3
    "additionally, the browser will still prompt you if an applet wants to elevate privileges, even with a valid cert" — and if the user wants to see dancing bunnies, he wants to see dancing bunnies. No matter how many warnings are in the way :-)
    – Joey
    Nov 16, 2009 at 11:53
  • 1
    @Tom: I can. End-users can't.
    – harrymc
    Nov 23, 2009 at 22:19
1

Don't install (or uninstall) Java from your machine and then you'll either not see anything or get a prompt asking you to install Java. This will tell you whether the site uses Java or not (but not before you load the site).

Improve this answer
2
  • Hmm, not exactly a 'quick' method :-)
    – Rabarberski
    Nov 16, 2009 at 9:33
  • True - but won't give you any false positives or false negatives ;)
    – ChrisF
    Nov 16, 2009 at 9:36
1

Both my Firefox and Safari state "Applet started" in their status bars. If things fail, I think that says "Applet failed to start". Still, the status bar is hardly reliable for troubleshooting.

In Windows there is that annoying icon in the notification area (next to the clock) whenever Java is active (or has some update to nag about). Unless you disabled that, I think that will always show whenever some applet is started? Again, if things fail, it might not show after all...

Improve this answer
0

I would say quickly open source, pressing Control+F, then typing object, and/or java and quickly looking.

Not very accurate as frames/Iframes may get in the way. The other way is simply open the page and see if it works or if you get any popups saying a plugin is required.

Improve this answer
0

A site may give you a Java plug-in error if you don't have Java installed. If you install it and get a recent version, the SECURITY tab of the Java console will provide site names that reveal who is using Java. To find sites that loaded objects on your workstation, view the object list. It too will list sites and the objects/classes that were downloaded that enabled you to interact with it via Java. All of this of course, occurs after you interact with a site and not before.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .