Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

4
votes
4answers
862 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
1
vote
1answer
439 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
1
vote
1answer
169 views

Developer Security Training .NET / JAVA [closed]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
7
votes
1answer
2k views

Are any Java Card 3.0 smart cards available?

The Java Card 3.0 specification (draft?) came out in 2008. It is now 2013. Are there any existing smart cards that actually implement the specification? How about USB tokens? The best I've found is ...
-5
votes
1answer
5k views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
4answers
549 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
0
votes
1answer
73 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
1
vote
2answers
1k views

Learning to script tools in Python and general Pen Testing

I want to learn Pen Testing and already know Java and have been learning Python and am fairly comfortable with Python syntax. I also have some knowledge on Linux and TCP/IP. My questions are: How can ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
2
votes
2answers
2k views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
4
votes
3answers
3k views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
2
votes
3answers
4k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
1
vote
0answers
398 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
1answer
242 views

Is it Possible for a Java Applet to Record Cursor Movements Inside the Applet? [closed]

I am using my mouse to interact with a Java applet in a browser. Clearly the party that owns the Java applet can record where I click inside the applet. What I'm wondering about now is whether it is ...
6
votes
5answers
1k views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
2
votes
1answer
312 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
2
votes
2answers
102 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
1
vote
1answer
721 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
2
votes
3answers
517 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
0
votes
1answer
1k views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
3
votes
1answer
924 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
9
votes
1answer
441 views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
0
votes
1answer
132 views

Executing external process from Java security

What are security implications of executing external processes using Java ProcessBuilder/Process? Example: Runtime rt = Runtime.getRuntime(); Process proc = rt.exec("processExecutable"); InputStream ...
1
vote
1answer
91 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
0
votes
1answer
169 views

Private and public key need to have same algorithm?

The private and the public key from the cert must have the same algorithm, correct? EDIT: Yes of course pub / priv are a key pair. So this code would be legal, to be more flexible (e.g. ECDSA or DSA): ...
3
votes
2answers
1k views

Is AES(Rijndael) faster than Blowfish?

I know theoretical that blowfish is much faster than aes. But I benchmarked several algorithms including aes and blowfish for 1MB, 5MB, 10MB etc. files in java 8 platform and bouncy castle library. In ...
17
votes
7answers
8k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
3
votes
1answer
2k views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
1
vote
2answers
1k views

Java SecureRandom generate secure random number

How to generate a secure random number bit length is 256 bits using Java. What is the different between: SecureRandom random = new SecureRandom(); and SecureRandom prng = ...
1
vote
1answer
2k views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
27
votes
3answers
2k views

Why did Java (JRE) vulnerabilities peak in 2012-2013?

I've taken a graph of the amount of CVE reports concerning the JRE per Year. Now as you can see this spiked in 2012-2013, which could have been guessed easily, if you look at the amount of news items ...
1
vote
2answers
2k views

Doesn't the same string encrypted with the same key generate the same encrypted value?

This is my page and class to encrypt the string entered and saved in database. Each time, the Key__c is the same, as I take it from custom settings. But when I enter abc and save two times, the ...
0
votes
1answer
1k views

What are the security features of JRE 8?

I was tasked with finding the security features of JRE 1.8 and compare it to JRE 1.7 update 51. When I try to look for new security though, it only shows ">JDK< Security Enhancements" (ie. Not ">...
1
vote
2answers
235 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
1
vote
1answer
1k views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
18
votes
4answers
5k views

How secure is Java's hashCode()?

On our views in a Java web application, currently I am using hashCode as Id's for objects so that at server end I can get the same object back. However, I am wondering how secure Java's hashCode ...
0
votes
2answers
858 views

Anti Virus Intergration

we have found an issue with some production systems that the Anti-Virus causes the program to become slow a lot of the times and generally interferes with the activity of our software. Now as far as I ...
0
votes
2answers
296 views

Any way to use Java (sun micro) without any concern of infection

My antivirus has kept removing a Java exp virus only for it to keep returning. Yesterday in frustration I decided to uninstall Java until I see some positive news about any patches regarding the ...
0
votes
1answer
234 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). I'...
0
votes
1answer
829 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
3
votes
1answer
6k views

Java Applet - Need Code Signing Certificate vs SSL Certificate

I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed. I used the certificate/key used for the apache2 ssl ...
1
vote
2answers
996 views

How can I determine the Java version running on a remote server?

Short version How can I determine the Java version a remote server is running if I only have access to the server through port 443? Long version I am validating a pentest run by another group. ...
1
vote
0answers
160 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
5
votes
3answers
737 views

Android and FIPS

I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric ...
1
vote
4answers
245 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
0
votes
1answer
318 views

Java Drive By & Stub - Explanation [closed]

I have been trying to make some extensions for chrome lately to block some unwanted stuff. I have also been searching for quite some time to find what a JDB does.So , the applet downloads a file , ...
7
votes
1answer
4k views

How securely random is Oracle's java.security.SecureRandom

There was a lot of news in the past year about exploitable weaknesses in cryptography which originated from weak random number generators. In some cases it was negligence on side of the developers, in ...
9
votes
4answers
3k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
4
votes
1answer
349 views

What are the major vulns that affect the Dalvik VM of Android?

I frequently hear about the security risks of using Android. But few people who write articles on this subject ever identify what parts of Android are at fault, nor do they identify design flaws. Can ...