security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

1
vote
0answers
79 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
1
vote
0answers
43 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
1
vote
1answer
422 views

Configuring GCM cipher suites in Jetty based server

I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented ...
1
vote
0answers
46 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
1
vote
0answers
31 views

Should we protect web application source code from being stolen by web hosts through obfuscation? [duplicate]

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code & probably even steal your business. If, so how to deal with this or how to obfuscate ? ...
0
votes
2answers
238 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
0
votes
2answers
71 views

Doesn't the same string encrypted with the same key generate the same encrypted value?

This is my page and class to encrypt the string entered and saved in database. Each time, the Key__c is the same, as I take it from custom settings. But when I enter abc and save two times, the ...
0
votes
1answer
76 views

What are the security features of JRE 8?

I was tasked with finding the security features of JRE 1.8 and compare it to JRE 1.7 update 51. When I try to look for new security though, it only shows ">JDK< Security Enhancements" (ie. Not ...
0
votes
1answer
160 views

encrypting a file with an RSA key

I wrote a java program to encrypt and decrypt files using AES algorithm in CBC mode and a random initialization vector. but there is something fundamental I'm not understanding:first I generate a ...
0
votes
1answer
397 views

What triggers a firewall to block a TCP socket?

I was wondering what would cause a firewall to block a TCP Java socket from connecting. What would trigger that?
0
votes
1answer
124 views

Did I get hit by the recent Java exploit?

Looks like the website iphonedevsdk was responsible for serving up the malware that's been causing some of the recent security exploits. According to my browser history, I visited that site back in ...
0
votes
2answers
66 views

Anti Virus Intergration

we have found an issue with some production systems that the Anti-Virus causes the program to become slow a lot of the times and generally interferes with the activity of our software. Now as far as I ...
0
votes
1answer
93 views

Java is running even after it is disabled [closed]

To prevent adds and pop-up that seduce users to install or download viruses I have disabled Java. But I have noticed that even with Java disables Firefox is still running it. The pop-ups are coming ...
0
votes
1answer
298 views

Can Veracode detect vulnerabilities in jsp files?

We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
0
votes
1answer
33 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
0
votes
1answer
45 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
0
votes
1answer
188 views

Learning to script tools in Python and general Pen Testing

I want to learn Pen Testing and already know Java and have been learning Python and am fairly comfortable with Python syntax. I also have some knowledge on Linux and TCP/IP. My questions are: How can ...
0
votes
1answer
519 views

Java SSL factory connection to SSL server (with just public-key and certificate)

I am trying to connect to a SSL web server. We currently have a pkcs12 file and connect, that is our private-key and certificate. Is it possible to connect using Java code with a public-key and ...
0
votes
2answers
342 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
1answer
166 views

Can SHA-1 PRNG still create secure cipher keys?

I am concerned that a SHA-1 PRNG cannot produce an AES-256 cipher key with the expected 256 bits of security, or indeed any secure cipher key where over 165 bits of security are expected. The SHA-1 ...
0
votes
1answer
596 views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
0
votes
1answer
534 views

Java SecureRandom generate secure random number

How to generate a secure random number bit length is 256 bits using Java. What is the different between: SecureRandom random = new SecureRandom(); and SecureRandom prng = ...
0
votes
1answer
50 views

How esignature verification process work?

I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
0
votes
2answers
208 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
0
votes
1answer
108 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
0answers
9 views

security block self-running java program [migrated]

I'm running a java program, but it is blocked by security software(maybe McAfee), the errors are: Java Plug-in 10.51.2.13 Using JRE version 1.7.0_51-b13 Java HotSpot(TM) Client VM User home directory ...
0
votes
1answer
108 views

Java Drive By & Stub - Explanation [closed]

I have been trying to make some extensions for chrome lately to block some unwanted stuff. I have also been searching for quite some time to find what a JDB does.So , the applet downloads a file , ...
0
votes
1answer
388 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
-1
votes
1answer
153 views

What are correct steps to setup this exploit execution(jboss_invoke_deploy)?

I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
-2
votes
2answers
299 views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
-2
votes
1answer
288 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
-4
votes
1answer
317 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
-4
votes
1answer
681 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...