security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

3
votes
1answer
480 views

How to debug/reverse engineer java applets?

I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
3
votes
3answers
659 views

Java 7u11 - Safer to switch to 6?

Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
3
votes
1answer
259 views

Multibyte Character Exploits JSP/PostgreSQL

I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
3
votes
1answer
77 views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
3
votes
1answer
87 views

secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please lets ...
3
votes
2answers
287 views

How to intercept url to disallow Forced Browsing in simple Dynamic Web Project?

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL ...
3
votes
0answers
444 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
2
votes
2answers
8k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
2
votes
3answers
429 views

Microsoft password strength checker

I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
2
votes
2answers
2k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
2
votes
4answers
524 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
2
votes
1answer
251 views

Taking root ownership

Just gonna make this clear first, this is for class! I have an assignment that requires to 1) modify a web server written in Java to accept file uploads and to use this to deface the homepage (did ...
2
votes
5answers
2k views

Website vulnerability scanner in Java && Open Source

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
2
votes
3answers
156 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
2
votes
4answers
1k views

Bouncy Castle - document signed by sender and only readable by receiver?

I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
2
votes
1answer
148 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
1answer
57 views

Is return oriented programming applicable to pure Java code?

I'm interested in ROP in the context of Java. For now, I don't consider the native code of the Java virtual machine. Is return oriented programming applicable to pure Java code?
2
votes
1answer
233 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
2
votes
4answers
175 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
2
votes
1answer
3k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
2
votes
1answer
1k views

How securely random is Oracle's java.security.SecureRandom

There was a lot of news in the past year about exploitable weaknesses in cryptography which originated from weak random number generators. In some cases it was negligence on side of the developers, in ...
2
votes
1answer
650 views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
2
votes
2answers
375 views

What is the correct way to assess and compare Certicom's products to the alternatives?

I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
2
votes
3answers
2k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
2
votes
2answers
38 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
2
votes
1answer
92 views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
2
votes
2answers
362 views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
2
votes
1answer
309 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
2
votes
1answer
3k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
1answer
531 views

How disable Java in Chrome 23?

Well in case someone doesn't know yet... there is a new Java zero day. I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on ...
2
votes
1answer
342 views

Is DWR (Direct Web Remoting) Secure?

Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
2
votes
1answer
118 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
2
votes
1answer
745 views

Configuring GCM cipher suites in Jetty based server

I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented ...
2
votes
1answer
167 views

Can Jasper files be used as shells to attack java web apps?

JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
2
votes
2answers
2k views

where can find sample coding for use of Bouncy Castle(java)?

I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but i haven't found any sample of coding in JAVA. Can anyone tell me how to call the ...
2
votes
1answer
634 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
2
votes
3answers
179 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
2
votes
0answers
105 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
2
votes
0answers
133 views

Need a little help with Metasploit and Java? [closed]

I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: ...
2
votes
1answer
356 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
4answers
177 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
1
vote
2answers
506 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
1
vote
4answers
463 views

Custom programming language, and translator that translate it to Java to make more difficult to get source

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into ...
1
vote
3answers
734 views

Java vulnerability applicability

On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application? See CVE-2011-3545, for which the vulnerable subcomponent is ...
1
vote
1answer
150 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
3answers
297 views

Java class type parameter vulnerability

In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
1
vote
4answers
225 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
1
vote
1answer
638 views

Preventing License protection circumvention in Java software

A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct. It achieves this by embedding the public key in the same Java software. Legit license ...
1
vote
1answer
517 views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
1
vote
1answer
251 views

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries. The other uses openssl and has been wrapped in java through the JNI. I'm ...