The reality is it can't really be done reliably. Although a regex string scan on the bytecode might yield some url like strings and you can probably decompile the applet anyway the problem is that (like with javascript) the actual link may be generated programatically ie it simply does not exist until runtime.

my $link = $prot . $domain . $script . $query;
[download]

Java applets are compiled code. The URL of the button is probably dynamically created -- I presume that's why it was made as an applet in the first place -- so the straightforward solution is to disassemble/decompile the applet and see what it's doing.

An alternative is to find a tool that clicks the button (maybe by sending keystrokes to the applet) and check which site gets loaded.

If site is loaded within the applet (as oppose to being loaded by the browser at the request of the applet), you could write your own security manager. I think all it takes is to write a subclass of java.lang.SecurityManager which overrides checkPermission with a method that looks for permissions of type java.net.SocketPermission. You could even throw a security exception if you don't want the site to actually be loaded.

do you happen to know the name of a tood that sends keystrokes? I did a cpan search for java.lang.securitymanager and it didnt return a module, do you know the actual module to use. a search for security in the java module didnt return anything either. By the way, firefox can view the source of the java applets by right clicking and hitting view source on the applet. it returns it in the html that is generated on the page. Is there a way for perl to do this?

thanks

No, I don't know of such a tool.

SecurityManager is part of Java.

"By the way, firefox can view the source of the java applets". I strongly doubt that. Have you been talking about JavaScript? Java and JavaScript are as different as Perl and C++.