security aspects specific to the Java programming language and libraries.
2
votes
1answer
176 views
Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?
Question
Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start")
...
1
vote
1answer
97 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
1
vote
1answer
71 views
Implementing a commitment scheme in java
Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated.
Thanks
2
votes
3answers
227 views
Microsoft password strength checker
I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
9
votes
1answer
588 views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if ...
4
votes
1answer
111 views
Security announcement mailing list for Java
I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products.
For example Apple provides such a ...
0
votes
0answers
113 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
5
votes
1answer
314 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
0
votes
0answers
152 views
Robust HTML Parser [closed]
I was reading a book(The Tangled Web) -- what I list below is my understanding of the steps involved in writing a good markup filter.
- build an in-memory document tree
- walk the tree
...
6
votes
6answers
676 views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
2
votes
2answers
414 views
safe to use jBCrypt and recommend it to my organization?
I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
-1
votes
1answer
447 views
Alternatives/mitigation to Oracle Java (JRE) [closed]
My company is researching a complete removal of JRE on our windows platform. I have researched several alternatives for implementation in a large enterprise architecture. Simply, wanted to throw the ...
3
votes
1answer
444 views
Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?
I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
2
votes
2answers
90 views
Secure Spring FrameworkUser Management
I got asked this question:
"Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)?
How do you guys do authz in Spring, including managing those roles ...
1
vote
3answers
147 views
Java class type parameter vulnerability
In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
-4
votes
1answer
314 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
4
votes
2answers
423 views
How should an application store its credentials
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
4
votes
3answers
293 views
Vulnerable java applications
I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
2
votes
2answers
911 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
2
votes
0answers
113 views
Need a little help with Metasploit and Java? [closed]
I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: ...
7
votes
4answers
486 views
Are Java applets more secure than regular forms for login?
In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
3
votes
2answers
238 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
8
votes
2answers
487 views
Why do some Java APIs bypass standard SecurityManager checks?
In Java, normally permission checks are handled by the SecurityManager. To prevent untrusted code from invoking privileged code and exploiting some bug in the privileged code, SecurityManager checks ...
0
votes
1answer
265 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
4
votes
2answers
838 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
2
votes
2answers
630 views
Java Applet for mutual authentication with smart card
I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client).
In order to do this I thought the following scheme:
1.Tomcat (server) send ...
2
votes
1answer
115 views
Security at writing in a folder
I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
1answer
406 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
198 views
Network Sniffing Java Applet Authentication
Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
0
votes
0answers
287 views
Java Servlet request.getRequestURL() logged abnormal string
I had asked this question in stackexchange.com ( http://stackoverflow.com/questions/10496410/java-servlet-request-getrequesturl-logged-abnormal-string/10496937#10496937). Since this place is more ...
2
votes
1answer
150 views
Is DWR (Direct Web Remoting) Secure?
Is DWR considered secure, or what may be required to secure Direct Web Remoting?
Are there better options for hardened asynchronous communication?
4
votes
2answers
275 views
Class.forName injection and constructor invocation
If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter)
What's the worst possible consequence?
The attacker does obtain stack traces. After ...
2
votes
4answers
745 views
Bouncy Castle - document signed by sender and only readable by receiver?
I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
1
vote
1answer
242 views
Preventing License protection circumvention in Java software
A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct.
It achieves this by embedding the public key in the same Java software.
Legit license ...
3
votes
1answer
184 views
Multibyte Character Exploits JSP/PostgreSQL
I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
1
vote
1answer
317 views
Best Practices for Storing Digital Certificate
I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
1
vote
1answer
102 views
DoS and Serialization
I got the following message from Fortify static code analyser.
Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks.
Can anyone ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
-1
votes
1answer
157 views
Number of time steps in TOTP [closed]
I am implementing TOTP in JAVA.Formula for number of time steps is T = (Current Unix time - T0) ÷ X.I have taken Current Unix time:long unixTime = System.currentTimeMillis()/1000L(1335246034) and T0 ...
0
votes
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
5
votes
1answer
5k views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
1
vote
0answers
3k views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
4
votes
3answers
275 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
2
votes
2answers
625 views
Secure communication between C# client and Java server, using certificates
I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on:
server send RSA public key to ...
3
votes
1answer
482 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
1
vote
1answer
319 views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
4
votes
3answers
929 views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
2
votes
2answers
386 views
Securing a Ubuntu system on Amazon Web Services
I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following:
A relatively simple Java-based website (using the Noir framework)
A Java-based ...
3
votes
4answers
358 views
Base64 conversion for byte array in encryption
I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
