security aspects specific to the Java programming language and libraries.
1
vote
1answer
102 views
DoS and Serialization
I got the following message from Fortify static code analyser.
Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks.
Can anyone ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
1
vote
1answer
110 views
Did I get hit by the recent Java exploit?
Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
1
vote
2answers
2k views
Encrypting string in javascript and decryption in java
I would like to know if someone know any library to do encryption in javascript and decryption in java. I have already tried many API, But getting not not getting same values in java.
I want ...
1
vote
2answers
95 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
98 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
1
vote
1answer
73 views
Implementing a commitment scheme in java
Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated.
Thanks
1
vote
1answer
171 views
Hardening JRE deployment - webjava
I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.
I have my system wide deployment config and properties files set up:
...
1
vote
2answers
86 views
Do XBAP applications have the same vulnerabilities as Java Web Apps?
In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications.
XBAP applications are similar to Silverlight but it offers more options to ...
1
vote
1answer
414 views
How do I use OpenSSL with the Java Keytool?
I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
1answer
201 views
Network Sniffing Java Applet Authentication
Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
1
vote
1answer
325 views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
1
vote
1answer
458 views
How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?
I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
1
vote
2answers
968 views
where can find sample coding for use of Bouncy Castle(java)?
I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but i haven't found any sample of coding in JAVA. Can anyone tell me how to call the ...
1
vote
0answers
35 views
AppEngine Sandbox
Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
1
vote
0answers
3k views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
0
votes
4answers
134 views
Is there a need to define “language safety”?
Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
0
votes
1answer
49 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
0
votes
2answers
173 views
Any way to use Java (sun micro) without any concern of infection
My antivirus has kept removing a java exp virus only for it to keep returning.
Yesterday in frustration i decided to uninstall Java until i see some positive news about any patches regarding the ...
0
votes
1answer
113 views
Can Veracode detect vulnerabilities in jsp files?
We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
0
votes
2answers
146 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
0
votes
1answer
233 views
Java SecureRandom generate secure random number
How to generate a secure random number bit length is 256 bits using Java. What is the different between:
SecureRandom random = new SecureRandom();
and
SecureRandom prng = ...
0
votes
1answer
39 views
How esignature verification process work?
I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
0
votes
2answers
144 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
0
votes
1answer
95 views
Manually monitoring your PC for Java (Oracle) exploits?
Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
0answers
48 views
Can Jasper files be used as shells to attack java web apps?
JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
0
votes
0answers
116 views
Encryption in Messaging/RAbbitMQ/SOA [closed]
I'm a student and now 2nd time poster, please excuse any lacking detail on my part.
For my exams I'm doing a cross-platorm application using RabbitMQ for messaging. It'll serve as POC for both SOA ...
0
votes
0answers
154 views
Robust HTML Parser [closed]
I was reading a book(The Tangled Web) -- what I list below is my understanding of the steps involved in writing a good markup filter.
- build an in-memory document tree
- walk the tree
...
0
votes
1answer
267 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
0
votes
0answers
289 views
Java Servlet request.getRequestURL() logged abnormal string
I had asked this question in stackexchange.com ( http://stackoverflow.com/questions/10496410/java-servlet-request-getrequesturl-logged-abnormal-string/10496937#10496937). Since this place is more ...
0
votes
0answers
519 views
Topics for undergrad thesis, suggestions please [closed]
I'm a CS university undergraduate student, currently in my last year of studies for my BSc (not MSc). Every student needs to submit a thesis in order to get the degree. I have the option to suggest a ...
-1
votes
1answer
82 views
What are correct steps to setup this exploit execution(jboss_invoke_deploy)?
I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
-1
votes
1answer
473 views
Alternatives/mitigation to Oracle Java (JRE) [closed]
My company is researching a complete removal of JRE on our windows platform. I have researched several alternatives for implementation in a large enterprise architecture. Simply, wanted to throw the ...
-1
votes
1answer
159 views
Number of time steps in TOTP [closed]
I am implementing TOTP in JAVA.Formula for number of time steps is T = (Current Unix time - T0) รท X.I have taken Current Unix time:long unixTime = System.currentTimeMillis()/1000L(1335246034) and T0 ...
-4
votes
1answer
315 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
-5
votes
1answer
78 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
-5
votes
0answers
28 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
-8
votes
0answers
43 views
Close the virtual machine (vmware) customer [closed]
It is possible to close the virtual machine (vmware) on this machine where it is installed, and leave the remote access only certain IP ?
