Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

1
vote
1answer
239 views

Simple way to secure a webservice used by mobile clients

I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information ...
1
vote
2answers
270 views

Overkill or appropriate?

I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server, and the database will be on its own ...
1
vote
1answer
205 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
1
vote
1answer
156 views

Developer Security Training .NET / JAVA [closed]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
1
vote
1answer
658 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
1
vote
2answers
210 views

How to avoid log4j output external modification

I had a request to find a solution for making a log file secure from editing from the user (not root user) running the JBoss instance of an application (Linux environment) First idea I had is to use ...
1
vote
2answers
910 views

How can I determine the Java version running on a remote server?

Short version How can I determine the Java version a remote server is running if I only have access to the server through port 443? Long version I am validating a pentest run by another group. ...
1
vote
3answers
2k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
1
vote
1answer
655 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
1
vote
2answers
1k views

Java SecureRandom generate secure random number

How to generate a secure random number bit length is 256 bits using Java. What is the different between: SecureRandom random = new SecureRandom(); and SecureRandom prng = ...
1
vote
2answers
533 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
222 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
1
vote
1answer
247 views

Implementing a commitment scheme in java

Are there any implementations of cryptographic commitment schemes available as API/libraries in Java? I looked around in the security package and couldn't find much. Any help is appreciated. Thanks
1
vote
2answers
85 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
1
vote
1answer
102 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
3answers
142 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
1
vote
1answer
33 views

Can I have CA with JSSE

Maybe the title isn't correct but what I am trying to understand is... I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. ...
1
vote
1answer
152 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
1
vote
3answers
315 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
1
vote
2answers
112 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
1
vote
1answer
195 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
1
vote
1answer
802 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
1
vote
1answer
855 views

Is there a way to verify a signed XML in Java

.NET has this great way to sign and then verify the signature of an XML file. Is there a way in Java to verify an XML file that .NET has signed this way? thanks - dave
1
vote
2answers
2k views

Understanding Java Security Providers

I'm hoping to use the below issue we came across recently to better understand Java's security providers, ciphers and encryption in general. We got the following error during an SSL Handshake (using ...
1
vote
2answers
534 views

How come PBEWITHSHA256AND128BITAES-CBC-BC violates the 128bit key limit?

In my Java application (which use StandardPBEStringEncryptor by jasypt), when i use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, i get an ...
1
vote
1answer
447 views

On File delete, using java File delete method what could be the security issue?

In my case, the static code analysis tool shows the issue when it founds the code like this boolean status = file.delete(); It issues the security vulnerability saying the validation is ...
1
vote
1answer
71 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
1
vote
1answer
618 views

ShellShock vulnerability and Java Web Applications

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability. Can someone exploit this vulnerabiity on my website ?
1
vote
1answer
156 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
1
vote
1answer
90 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
1
vote
3answers
1k views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
1
vote
1answer
805 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
1answer
1k views

Convert a DER encoded Certificate to PEM encoded Certificate

I have a p7b certificate(DER encoded) which I need to convert to a PEM encoded certificate so that I can import it into my keystore. I see that the openssl command below does the job of the ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
1
vote
3answers
117 views

Symmetric encryption involving load balancers - can't randomize key?

I'm working on encrypting a web application's cookie. Using symmetric AES/CBC, I encrypt the cookie data before writing it out, and then decrypt it when reading it back in - the standard stuff. The ...
1
vote
1answer
362 views

NTRU java attack implementation

I'm researching NTRU cryptosystem and started research based on source code from sourceforge and bouncy castle(java language). Currently I'm reseacrhing attacks on NTRU, based on CVP and SVP. But I'd ...
1
vote
1answer
222 views

AppEngine Sandbox

Does anyone know how the AppEngine sandbox is implemented? I heard they use a SecurityManager with Java but surely they are using another layer as well like LXC. I've looked at the whitelist and there ...
1
vote
1answer
2k views

Hardening JRE deployment - webjava

I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network. I have my system wide deployment config and properties files set up: ...
1
vote
2answers
389 views

Do XBAP applications have the same vulnerabilities as Java Web Apps?

In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications. XBAP applications are similar to Silverlight but it offers more options to ...
1
vote
1answer
643 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
1
vote
1answer
586 views

Network Sniffing Java Applet Authentication

Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
1
vote
1answer
1k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
1
vote
0answers
33 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
1
vote
0answers
25 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
45 views

How to disable weak cipher suits in java application server for ssl

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do ...
1
vote
0answers
14 views

Using TLS 1.2 from java 6 [migrated]

We have a legacy web application that runs in a tomcat under java 6, upgrading to 7 or 8 is infeasible as the application needs significant work to allow this and the fixes required are too large to ...
1
vote
0answers
18 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += ...
1
vote
0answers
108 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
0answers
65 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
1
vote
0answers
37 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication ...