security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

-5
votes
1answer
960 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
4answers
225 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
0
votes
1answer
43 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
1
vote
2answers
421 views

Learning to script tools in Python and general Pen Testing

I want to learn Pen Testing and already know Java and have been learning Python and am fairly comfortable with Python syntax. I also have some knowledge on Linux and TCP/IP. My questions are: How can ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
3
votes
1answer
2k views

Encrypting data within SQLite database in JAVA - How to store key?

So, a bit of context before I start may be handy. I am developing a JAVA desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
-1
votes
1answer
78 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
2
votes
2answers
359 views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
1
vote
1answer
251 views

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries. The other uses openssl and has been wrapped in java through the JNI. I'm ...
1
vote
0answers
29 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
4
votes
3answers
539 views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
8
votes
0answers
137 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
2
votes
3answers
2k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
0
votes
0answers
47 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
0
votes
0answers
181 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
1answer
67 views

Is it Possible for a Java Applet to Record Cursor Movements Inside the Applet? [closed]

I am using my mouse to interact with a Java applet in a browser. Clearly the party that owns the Java applet can record where I click inside the applet. What I'm wondering about now is whether it is ...
5
votes
5answers
284 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
1
vote
1answer
77 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
2
votes
2answers
38 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
1
vote
1answer
183 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
2
votes
3answers
179 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
0
votes
1answer
487 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
3
votes
1answer
576 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
2
votes
1answer
91 views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
0
votes
1answer
50 views

Executing external process from Java security

What are security implications of executing external processes using Java ProcessBuilder/Process? Example: Runtime rt = Runtime.getRuntime(); Process proc = rt.exec("processExecutable"); InputStream ...
1
vote
1answer
72 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
0
votes
1answer
60 views

Private and public key need to have same algorithm?

The private and the public key from the cert must have the same algorithm, correct? EDIT: Yes of course pub / priv are a key pair. So this code would be legal, to be more flexible (e.g. ECDSA or DSA): ...
3
votes
2answers
324 views

Is AES(Rijndael) faster than Blowfish?

I know theoretical that blowfish is much faster than aes. But I benchmarked several algorithms including aes and blowfish for 1MB, 5MB, 10MB etc. files in java 8 platform and bouncy castle library. In ...
16
votes
7answers
5k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
3
votes
1answer
808 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
6
votes
1answer
15k views

PKCS7 encoding in Java without external libs like BouncyCastle etc

I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms). I have x509certificate from the keystore, rsa private key, ContentInfo. ContentType is "oidPkcs7Data". ...
0
votes
0answers
395 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
0
votes
2answers
916 views

Java SecureRandom generate secure random number

How to generate a secure random number bit length is 256 bits using Java. What is the different between: SecureRandom random = new SecureRandom(); and SecureRandom prng = ...
1
vote
1answer
1k views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
2
votes
2answers
2k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
24
votes
3answers
2k views

Why did Java (JRE) vulnerabilities peak in 2012-2013?

I've taken a graph of the amount of CVE reports concerning the JRE per Year. Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
0
votes
2answers
461 views

Doesn't the same string encrypted with the same key generate the same encrypted value?

This is my page and class to encrypt the string entered and saved in database. Each time, the Key__c is the same, as I take it from custom settings. But when I enter abc and save two times, the ...
0
votes
1answer
263 views

What are the security features of JRE 8?

I was tasked with finding the security features of JRE 1.8 and compare it to JRE 1.7 update 51. When I try to look for new security though, it only shows ">JDK< Security Enhancements" (ie. Not ...
1
vote
2answers
79 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
1
vote
1answer
644 views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
17
votes
4answers
3k views

How secure is Java's hashCode()?

On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back. However, I am wondering how secure Java's hashCode ...
0
votes
2answers
227 views

Anti Virus Intergration

we have found an issue with some production systems that the Anti-Virus causes the program to become slow a lot of the times and generally interferes with the activity of our software. Now as far as I ...
0
votes
2answers
863 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
2answers
278 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
0
votes
1answer
76 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
0
votes
1answer
259 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
2
votes
1answer
3k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
1
vote
0answers
154 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
1
vote
2answers
401 views

How can I determine the Java version running on a remote server?

Short version How can I determine the Java version a remote server is running if I only have access to the server through port 443? Long version I am validating a pentest run by another group. ...
8
votes
3answers
961 views

Is Java relevant to Information Security?

I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a ...