Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

0
votes
2answers
1k views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
4
votes
0answers
869 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
2
votes
0answers
47 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
2answers
94 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
1
vote
1answer
107 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
142 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
2
votes
1answer
31 views

SSL with both local client and server

I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site. I want to give both server and client ...
2
votes
1answer
171 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
0
votes
0answers
47 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
0
votes
1answer
106 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
2
votes
1answer
97 views

Does TrustManager PKIX (or RFC 3280/X.509) really check client certificate expiration date?

It was noticed that default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check expiration date of client's certificate during ...
2
votes
4answers
3k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
1
vote
0answers
132 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
4
votes
2answers
294 views

Questions about TLS handshaking process

I am trying to understand how TLS works. Assuming the I have a java client that uses TLSv1 to communicate to the server which supports TLSv1.2, can the client talk to the server successfully? When a ...
5
votes
3answers
259 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
1
vote
3answers
146 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
0
votes
1answer
253 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
0
votes
1answer
87 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
2
votes
0answers
371 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
-7
votes
1answer
103 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere ...
0
votes
0answers
21 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
1
vote
0answers
68 views

Secure Web app by user credential and secure REST API within app via best secure method in spring security [closed]

I have a web application which has a single page AngularJS and Spring Security.application going to login via HTTP basic and Hibernate. My application has a REST API. Now how do I secure my REST API ...
2
votes
1answer
130 views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
2
votes
1answer
99 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
3
votes
1answer
1k views

How to resolve Path Manipulation error given by fortify?

I need to read the properties file kept in user home folder. PropertyFile=System.getProperty("user.home")+System.getProperty("file.separator")+"sample.properties"; Fortify is giving path ...
3
votes
3answers
53 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
2
votes
1answer
39 views

is there a workaround for CVE-2015-2625?

we are not able to upgrade jdk 6 to jdk1.8u51 where this issue (CVE-2015-2625) is fixed. is there a workaround one can have until we migrate to jdk1.8?
0
votes
1answer
368 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
1
vote
1answer
33 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
1
vote
1answer
169 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
3
votes
2answers
311 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
3
votes
0answers
140 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
3
votes
2answers
665 views

Penetrate Testing Java Web Applications

First thing first; this is something I have never done before. I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an ...
3
votes
1answer
124 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar ...
1
vote
3answers
219 views

How to store & use sensitive data in Java

I have a several Spring Boot applications that use BCryptPasswordEncoder to encrypt data I'll never need to directly use again - passwords, for example. However, I have quite a bit of sensitive data ...
1
vote
2answers
132 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
0
votes
0answers
238 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
1
vote
0answers
53 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
1answer
75 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...
0
votes
1answer
124 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. I am wondering if the code signing certificate (the “final cert”) must already be in ...
1
vote
2answers
152 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...
2
votes
1answer
230 views

AES encryption between Java and Ruby: what is the default mode and padding for AES in Java?

I'm writing a ruby app that needs to create some encryption that our java app needs to be able to decrypt. For this I have done some research, and I have this Java code now: Cipher cipher = ...
4
votes
0answers
3k views

Apache vs Jetty with regard to Security [closed]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
3
votes
2answers
288 views

Where should a keystore (.jks) be stored in a repository

I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
2
votes
0answers
143 views

Code execution through JSP RFI?

I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps. I've created a vulnerable application that imports a JSP page from another server to replicate the ...
6
votes
2answers
111 views

JAVA (Web Application) Public Data Assigned to Private Array-Typed Field

Referring to this CWE-496, it mentions that because of the application assigning public data to a private array it is equivalent to giving public access to the array. This is not clear to me because ...
22
votes
3answers
3k views

Is Java secure for the desktop? [duplicate]

The Java plugin for web browsers is known to have many security issues, at least in the past. Google Chrome is not even supporting it any more, describing it as decrepit technology, and Firefox having ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
22
votes
3answers
2k views

Java SE 8, Update 51 Added “Native Sandbox” Protection for Windows PCs. Wait, what?

So I was doing a little research about differences (if any) between the sandboxing models for Windows 8/8.1 applications and windows 10 applications when I stumbled across something rather ...
2
votes
1answer
145 views

MitM Android Java Application

I'm trying to MitM an Android Application for research purposes (it's designed to be broken). I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the ...