Tagged Questions

0
votes
0answers
147 views

GWAPT - Training Experiences/Questions [closed]

I'm heavily considering the GWAPT certificate, I'm wondering: http://www.giac.org/certification/web-application-penetration-tester-gwapt Has anyone done the online version of it? What is it like? Is ...
2
votes
2answers
306 views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
2
votes
2answers
618 views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
9
votes
2answers
831 views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the ...
8
votes
3answers
24k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
11
votes
1answer
1k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
7
votes
4answers
1k views

Can Javascript/Flash verify the SSL connection to prevent “SSL Inspection”?

I'd like to determine if an SSL webpage is being debugged through Fiddler, or if it's going through an SSL Proxy. So some people may ask What is the point of re-validating SSL using javascript? ...