security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

0
votes
1answer
243 views

Auto deploy war file (backdoor/shell) to particular folder [closed]

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
0
votes
1answer
102 views

How to modify a certificate using getTBSCertificate() method

I want to show that if I modify one bit or byte from a given X509 certificate the signature verification results false (because this modification results different hash value from the certificate). ...
0
votes
1answer
370 views

what freeware tool for java source code review? [closed]

I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.
0
votes
1answer
1k views

Java SSL factory connection to SSL server (with just public-key and certificate)

I am trying to connect to a SSL web server. We currently have a pkcs12 file and connect, that is our private-key and certificate. Is it possible to connect using Java code with a public-key and ...
0
votes
2answers
1k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
0
votes
1answer
1k views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
0
votes
1answer
73 views

How esignature verification process work?

I have a web application in which the users will be signing an html report. I know how the digital signature authentication works. But here the user will literally be signing the document (So, Should ...
0
votes
2answers
252 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
0
votes
1answer
126 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
0
votes
1answer
530 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
0
votes
0answers
35 views

What is the difference of TrustManager PKIX and SunX509?

Java's JSSE provides two different TrustManagers: PKIX and SunX509 I tried to find out what the differences between both are, but couldn't find any in the documentation. Can you tell me the ...
0
votes
0answers
173 views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
0
votes
0answers
25 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
0
votes
1answer
203 views

Java TLS1.0 POODLE

Does java implementation affected? https://www.imperialviolet.org/2014/12/08/poodleagain.html
0
votes
0answers
73 views

Considerations for using in-memory file system in a Java web application?

I was reviewing some code for a Java based web application accessible by authenticated users. It used the file system to work with temporary files, some of which have sensitive data. The input is a ...
0
votes
1answer
133 views

jRAT virus on Linux

I dumbly downloaded a .jar file that contained jRAT. When run, it stalls, gives a FileNotFoundException, then crashes. When I ls'd, the jar was there. When I cd'd out and back in, the jar was gone. ...
0
votes
0answers
33 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
0
votes
0answers
79 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
0
votes
1answer
252 views

Java Drive By & Stub - Explanation [closed]

I have been trying to make some extensions for chrome lately to block some unwanted stuff. I have also been searching for quite some time to find what a JDB does.So , the applet downloads a file , ...
-1
votes
1answer
256 views

What are correct steps to setup this exploit execution(jboss_invoke_deploy)?

I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...
-1
votes
1answer
208 views

Use openssl key to decrypt file in android/java [closed]

I want to decrypt file encrypted in openssl in java. File is encrypted with private key using openssl and on java side i want to decrypt it using public key. The code: public void testRSA() throws ...
-1
votes
1answer
74 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
-1
votes
1answer
79 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
-2
votes
2answers
648 views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
-2
votes
1answer
756 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
-4
votes
1answer
682 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
-4
votes
1answer
92 views

How to create a secure channel in Java?

I am creating a certification server which takes some required details like name, email etc from clients and issues public and private keys using RSA along with digital certificate. Initially all ...
-4
votes
1answer
1k views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
-6
votes
1answer
2k views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...