security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

0
votes
1answer
68 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
2
votes
0answers
187 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
-7
votes
1answer
69 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere ...
0
votes
0answers
15 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
2
votes
0answers
40 views

Secure Web app by user credential and secure REST API within app via best secure method in spring security [closed]

I have a web application which has a single page AngularJS and Spring Security.application going to login via HTTP basic and Hibernate. My application has a REST API. Now how do I secure my REST API ...
2
votes
1answer
49 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
3
votes
3answers
45 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
1
vote
3answers
107 views

How to store & use sensitive data in Java

I have a several Spring Boot applications that use BCryptPasswordEncoder to encrypt data I'll never need to directly use again - passwords, for example. However, I have quite a bit of sensitive data ...
2
votes
1answer
36 views

is there a workaround for CVE-2015-2625?

we are not able to upgrade jdk 6 to jdk1.8u51 where this issue (CVE-2015-2625) is fixed. is there a workaround one can have until we migrate to jdk1.8?
1
vote
1answer
30 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
2
votes
1answer
109 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
1
vote
2answers
91 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
3
votes
2answers
317 views

Penetrate Testing Java Web Applications

First thing first; this is something I have never done before. I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an ...
3
votes
2answers
208 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
3
votes
0answers
113 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
-1
votes
1answer
103 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
1
vote
3answers
114 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
3
votes
1answer
79 views

Malicious RCE functions in CGI and Java

I know there are some functions in CGI and Java that can be abused to perform remote code execution attack. For example we can see abuse of "eval" function in Movable Type CMS: sub ...
7
votes
3answers
6k views

Reverse engineering and Java

Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
3
votes
1answer
81 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
23
votes
3answers
936 views

Java SE 8, Update 51 Added “Native Sandbox” Protection for Windows PCs. Wait, what?

So I was doing a little research about differences (if any) between the sandboxing models for Windows 8/8.1 applications and windows 10 applications when I stumbled across something rather ...
0
votes
1answer
240 views

breaking down RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING

So Java has a mode called RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING. What does that even mean? RFC3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, section ...
0
votes
0answers
167 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
1
vote
0answers
52 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
1answer
64 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...
0
votes
1answer
77 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
1
vote
2answers
100 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...
3
votes
0answers
1k views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
2
votes
1answer
168 views

AES encryption between Java and Ruby: what is the default mode and padding for AES in Java?

I'm writing a ruby app that needs to create some encryption that our java app needs to be able to decrypt. For this I have done some research, and I have this Java code now: Cipher cipher = ...
2
votes
0answers
99 views

Code execution through JSP RFI?

I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps. I've created a vulnerable application that imports a JSP page from another server to replicate the ...
2
votes
2answers
89 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
5
votes
2answers
86 views

JAVA (Web Application) Public Data Assigned to Private Array-Typed Field

Referring to this CWE-496, it mentions that because of the application assigning public data to a private array it is equivalent to giving public access to the array. This is not clear to me because ...
23
votes
3answers
3k views

Is Java secure for the desktop? [duplicate]

The Java plugin for web browsers is known to have many security issues, at least in the past. Google Chrome is not even supporting it any more, describing it as decrepit technology, and Firefox having ...
2
votes
1answer
103 views

MitM Android Java Application

I'm trying to MitM an Android Application for research purposes (it's designed to be broken). I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the ...
9
votes
3answers
2k views

Are there any established secure coding guidelines available for mobile devices?

I am looking for secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. Would it be a good approach to use a ...
27
votes
7answers
505 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
3
votes
3answers
1k views

Difference between OpenSSL and keytool

I was wondering about differences between using OpenSSl or Keytool and generating certificates by them. I think Keytool is used by Java community but for someone who is not remotely connected to Java ...
2
votes
1answer
416 views

What is the difference of TrustManager PKIX and SunX509?

Java's JSSE provides two different TrustManagers: PKIX and SunX509 I tried to find out what the differences between both are, but couldn't find any in the documentation. Can you tell me the ...
2
votes
2answers
92 views

Is a precompiled Java program affected by Java vulnerabilities?

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java. Now there exist programs like ...
4
votes
1answer
175 views

Vulnerability of Java software

The JAVA software provided by Oracle is a security mess. But what exactly, in that software package is the most vulnerable. If someone install it and disables the Java plugin in the browser, will he ...
1
vote
1answer
182 views

keytool -genseckey -alias TDES -keyalg DESede -keysize 128 works within jre/bin folder but not when the keytool.exe is on another location

I would like to create a TDES key with size 128bits and 2KTDES key with 192bits for authentication in a Desfire smart card. Hence I have used the keytool to generate the jceks with the following ...
2
votes
0answers
74 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
0
votes
0answers
47 views

Java: tokens in memory and garbage collection

I was thinking today about whether this piece of code is secure: String token = <<**token received from REST API call**>> String encryptedToken = Base64.encodeToString(token.getBytes(), ...
8
votes
2answers
4k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
1
vote
3answers
258 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
0
votes
0answers
99 views

How to add a certificate chain to a JKS

I want to setup a KeyStore which contains certificate-chains only. This is required by a PKE system which uses the PublicKey of the desired certificate for encryption an then sends the cipher to the ...
0
votes
0answers
452 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
3
votes
3answers
408 views

Decrypt Java Payload

I found some destructive activity on my JBoss server and after a lot of google searching I found this exploit https://www.exploit-db.com/exploits/36575/ . I know the attacker uses this exploit to ...
1
vote
2answers
93 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...