Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

3
votes
0answers
232 views

Security for Hospital IT

I'm developing a program in Java intended to be utilized in a hospital. The system uses RMI internally between workstations and the server program. The program would be installed on the hospital's ...
0
votes
0answers
36 views

JAAS Authorization with OSGi

I have a custom permission called SomePermission which extends the BasicPermission class. Also I have following entry in the policy file. grant principal org.sample.jaas.pincipal.SomePrincipal "admin"...
36
votes
8answers
4k views

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
4
votes
4answers
939 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
3
votes
2answers
296 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
1
vote
0answers
40 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
4
votes
2answers
107 views

Can you ever get partially decrypted data from a decryption algorithm?

I'm decrypting some data using Java and Apache's most recent WSS4J library with 128-bit AES decryption. I setup the the cipher which appears to be correct with the right padding, decryption algorithm,...
0
votes
0answers
107 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
0
votes
1answer
75 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
6
votes
1answer
137 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
3
votes
1answer
54 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone https://android.googlesource....
0
votes
2answers
2k views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
4
votes
0answers
1k views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
2
votes
0answers
50 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
2answers
105 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
1
vote
1answer
117 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
2
votes
1answer
174 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
2
votes
1answer
31 views

SSL with both local client and server

I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site. I want to give both server and client ...
2
votes
1answer
203 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
0
votes
0answers
51 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...
0
votes
1answer
119 views

Securing Java REST Api for Saas usecase

I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring). I had a look at ...
2
votes
1answer
120 views

Does TrustManager PKIX (or RFC 3280/X.509) really check client certificate expiration date?

It was noticed that default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check expiration date of client's certificate during ...
2
votes
4answers
3k views

Can CVE-2015-4852 be exploited against WebLogic servers after a load balancer?

I have Java applications served by Oracle WebLogic servers that are after a load balancer. The WebLogic t3 protocol (vulnerable) is not tunneled to the WebLogic servers, only the HTTP requests. In ...
1
vote
0answers
158 views

How to import Comodo certificates into Keystore?

I'm trying to create a Keystore. I've already generated a Private Key, generated and sent a certificate request to a CA (Comodo), and I've received a ZIP file from the CA (Comodo) containing four ...
4
votes
2answers
309 views

Questions about TLS handshaking process

I am trying to understand how TLS works. Assuming the I have a java client that uses TLSv1 to communicate to the server which supports TLSv1.2, can the client talk to the server successfully? When a ...
5
votes
3answers
259 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
1
vote
3answers
149 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
0
votes
2answers
290 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
0
votes
1answer
94 views

Protecting a jar file from being used by unauthorized parties

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. To achieve this, I have obfuscated the ...
2
votes
0answers
408 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
-7
votes
1answer
111 views

making a login server [closed]

please can someone explain to me how I would go about making a login service? I know the basic steps: Get the username, store it somewhere Get the password, translate to MD5 and store somewhere End.....
0
votes
0answers
23 views

SCEP CertRep SUCCESS: how many certs are in the response?

I am working on an SCEP implementation (both requester and authority). The project uses JScep as a library. During the communication for a PKCSReq the client receives a CertRep SUCCESS. The draft ...
1
vote
0answers
72 views

Secure Web app by user credential and secure REST API within app via best secure method in spring security [closed]

I have a web application which has a single page AngularJS and Spring Security.application going to login via HTTP basic and Hibernate. My application has a REST API. Now how do I secure my REST API ...
2
votes
1answer
152 views

How to revoke certificates, or generate CRL files with Keytool

I didn't find how to use java keytool to revoke certificates or generate CRL files. Is it possible to do that with keytool? If no, how to do it with openssl ?
2
votes
1answer
118 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
3
votes
1answer
1k views

How to resolve Path Manipulation error given by fortify?

I need to read the properties file kept in user home folder. PropertyFile=System.getProperty("user.home")+System.getProperty("file.separator")+"sample.properties"; Fortify is giving path ...
3
votes
3answers
56 views

Java with LIS system

I'm not well versed in technology but have a problem that maybe you experts could answer. We have a software application that supports our laboratory - obviously must be secure. We want to be able to ...
2
votes
1answer
39 views

is there a workaround for CVE-2015-2625?

we are not able to upgrade jdk 6 to jdk1.8u51 where this issue (CVE-2015-2625) is fixed. is there a workaround one can have until we migrate to jdk1.8?
0
votes
1answer
431 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
1
vote
1answer
34 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
1
vote
1answer
194 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
3
votes
2answers
339 views

Why Antivirus Detects Simple Java Program as Trojan?

Just now I was testing a very simple code in java when I noticed a strange thing.......... On Compiling the program My antivirus detected it as trojan and deleted the jar file....... Further it is not ...
3
votes
0answers
151 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
3
votes
2answers
819 views

Penetrate Testing Java Web Applications

First thing first; this is something I have never done before. I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an ...
3
votes
1answer
132 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar [...
1
vote
3answers
260 views

How to store & use sensitive data in Java

I have a several Spring Boot applications that use BCryptPasswordEncoder to encrypt data I'll never need to directly use again - passwords, for example. However, I have quite a bit of sensitive data (...
1
vote
2answers
134 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
0
votes
0answers
244 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
1
vote
0answers
54 views

Theory behind certificate for job account

I made it work a job account protected by a certificate in a java spring application but is not that clear to me the minimal steps.(Could you believe that :) I need some theory. Here my steps: ...
1
vote
1answer
79 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...