Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

15
votes
2answers
5k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
0
votes
1answer
10 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
2answers
39 views

What is the purpose/role of the “alias” attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
-4
votes
2answers
115 views

Java security risk? [on hold]

Why is this code considered dangerous or vulnerable? String sFileName = request.getParameter("fName"); if (sFileName.toLowerCase().endsWith(".pdf")) // open file else // don’t open the file
5
votes
1answer
63 views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
2
votes
0answers
371 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
0
votes
0answers
27 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
1
vote
1answer
75 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
3
votes
1answer
3k views

Is keystore file (server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I used to generate the .p7b file: I generated a .jks (java keystore) file using ...
2
votes
1answer
37 views

Trusting HTMLUnit with Banking Details

I figured this was a good place to learn a little about trusting libraries such as HTMLUnit with sensitive information. I want to build a service that categorises my spending, kind of like my own ...
2
votes
1answer
47 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
3
votes
1answer
60 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
1
vote
0answers
35 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
3
votes
2answers
283 views

Where should a keystore (.jks) be stored in a repository

I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
1
vote
1answer
30 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
0
votes
1answer
124 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. I am wondering if the code signing certificate (the “final cert”) must already be in ...
2
votes
1answer
276 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
0
votes
1answer
252 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
1
vote
1answer
141 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
7
votes
2answers
261 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
1
vote
0answers
40 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
6
votes
1answer
105 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
0
votes
1answer
52 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
1
vote
0answers
30 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
46 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
1
vote
2answers
132 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
3
votes
3answers
106 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
1
vote
1answer
89 views

How to disable weak cipher suits in java application server for ssl

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do ...
0
votes
1answer
63 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
2
votes
2answers
328 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet. Of course this does not ...
3
votes
1answer
50 views

Do I put my subordinate (intermediate) or root CA certificate in my truststore?

I have a server using a certificate signed by my subordinate (intermediate) CA. My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates ...
0
votes
1answer
998 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
0
votes
0answers
59 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
0answers
18 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += ...
-1
votes
1answer
39 views

Security issues for a Java program that is a consumer of streaming radio

Are there any security issues I should be aware of when opening a Socket connection with the url/port of a streaming radio station? I have written some code to do this (no web stuff, just some ...
1
vote
0answers
108 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
2answers
88 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
-1
votes
1answer
121 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
3
votes
2answers
99 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
2answers
2k views

Is it safe to enable SSLv2 ClientHello support?

In the wake of the POODLE attack, many web sites have dropped support for SSLv3. But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello ...
3
votes
1answer
7k views

Encrypting data within SQLite database in Java - How to store key?

So, a bit of context before I start may be handy. I am developing a Java desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
4
votes
1answer
50 views

Is there a PRNG in Java with a period of at least 256 bits?

From what I can tell, Sun JRE/JDK's are limited to only providing 128-bit strong cryptography without downloading an unlimited strength jurisdiction policy files. My question is, if I install theses ...
5
votes
4answers
525 views

Untrusted signature on java app for downloading youtube, harmful?

If you visit most of the "online youtube download" pages, you will get this message: Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
1
vote
0answers
78 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
4
votes
1answer
124 views

How secure is my software for file encryption with AES-256?

I'm working on a project to build software for file encryption with AES in Java, it's operation is quite simple, but I was wondering if it is really safe. The program prompts the user for a ...
49
votes
5answers
168k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
0
votes
1answer
364 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
0
votes
1answer
89 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...