security aspects specific to the Java programming language and libraries.
0
votes
2answers
146 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
2
votes
2answers
424 views
safe to use jBCrypt and recommend it to my organization?
I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
2
votes
1answer
401 views
How disable Java in Chrome 23?
Well in case someone doesn't know yet... there is a new Java zero day.
I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on ...
2
votes
2answers
214 views
Where do I get started in terms of learning how to exploit Java and Flash vulnerabilities? or browser exploitation in general
Another Java 0day was discovered today which got me thinking how browser exploitation (remote execution on clients browser) works.
I am unable to find any books or resources online about browser ...
3
votes
4answers
676 views
Writing malware in java?
To me, it seemed like malware could never be written in java. Those who taught me java said it was "secure" and did not allow "low-level access" like c,c++.
But, I discovered that it can be done - ...
1
vote
2answers
95 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
75 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
144 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
3
votes
2answers
349 views
How secure is opening an incoming port for a java application?
If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be ...
0
votes
1answer
95 views
Manually monitoring your PC for Java (Oracle) exploits?
Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
4
votes
1answer
836 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
0
votes
2answers
173 views
Any way to use Java (sun micro) without any concern of infection
My antivirus has kept removing a java exp virus only for it to keep returning.
Yesterday in frustration i decided to uninstall Java until i see some positive news about any patches regarding the ...
2
votes
1answer
187 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
1
vote
1answer
73 views
Implementing a commitment scheme in java
Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated.
Thanks
8
votes
5answers
2k views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
9
votes
1answer
616 views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if ...
2
votes
3answers
229 views
Microsoft password strength checker
I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
4
votes
1answer
111 views
Security announcement mailing list for Java
I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products.
For example Apple provides such a ...
0
votes
0answers
116 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
2
votes
2answers
90 views
Secure Spring FrameworkUser Management
I got asked this question:
"Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)?
How do you guys do authz in Spring, including managing those roles ...
5
votes
1answer
326 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
0
votes
0answers
154 views
Robust HTML Parser [closed]
I was reading a book(The Tangled Web) -- what I list below is my understanding of the steps involved in writing a good markup filter.
- build an in-memory document tree
- walk the tree
...
6
votes
3answers
642 views
Are there any established mobile security frameworks or secure coding guidelines available?
I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5.
If there are no ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
-1
votes
1answer
475 views
Alternatives/mitigation to Oracle Java (JRE) [closed]
My company is researching a complete removal of JRE on our windows platform. I have researched several alternatives for implementation in a large enterprise architecture. Simply, wanted to throw the ...
4
votes
3answers
3k views
What password-based encryption to use with standard Java 6?
Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
2
votes
2answers
641 views
Java Applet for mutual authentication with smart card
I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client).
In order to do this I thought the following scheme:
1.Tomcat (server) send ...
3
votes
1answer
444 views
Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?
I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
1
vote
1answer
414 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
3answers
148 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
8
votes
3answers
25k views
How can I export my private key from a Java Keytool keystore?
I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
-4
votes
1answer
315 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
6
votes
1answer
628 views
Is there any recommended Java library for penetration testing?
Does anyone have any recommendations for a good Java library which can be used for penetration testing?
I once read about a library which I think was called 'Attack lib' but I can't find it anymore.
...
4
votes
2answers
442 views
How should an application store its credentials
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
4
votes
3answers
296 views
Vulnerable java applications
I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
3
votes
2answers
926 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
1
vote
3answers
481 views
Java vulnerability applicability
On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application?
See CVE-2011-3545, for which the vulnerable subcomponent is ...
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
2
votes
0answers
113 views
Need a little help with Metasploit and Java? [closed]
I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: ...
7
votes
4answers
487 views
Are Java applets more secure than regular forms for login?
In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
3
votes
2answers
242 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
8
votes
2answers
503 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
0
votes
1answer
267 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
2
votes
1answer
118 views
Security at writing in a folder
I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
1answer
201 views
Network Sniffing Java Applet Authentication
Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
0
votes
0answers
289 views
Java Servlet request.getRequestURL() logged abnormal string
I had asked this question in stackexchange.com ( http://stackoverflow.com/questions/10496410/java-servlet-request-getrequesturl-logged-abnormal-string/10496937#10496937). Since this place is more ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
2
votes
1answer
154 views
Is DWR (Direct Web Remoting) Secure?
Is DWR considered secure, or what may be required to secure Direct Web Remoting?
Are there better options for hardened asynchronous communication?
2
votes
4answers
757 views
Bouncy Castle - document signed by sender and only readable by receiver?
I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
4
votes
2answers
279 views
Class.forName injection and constructor invocation
If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter)
What's the worst possible consequence?
The attacker does obtain stack traces. After ...
