Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

1
vote
1answer
35 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
6
votes
1answer
135 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
3
votes
0answers
15 views

Does Oracle's GuardedString protect sensitive data against heap or memory dumps?

Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation: The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by ...
0
votes
0answers
10 views

How do I perform output encoding on text boxes having limited sizes? [on hold]

How do I apply output encoding for a text box which only allows a limited size? I cannot perform input validation for that text box because it expects '<' and '>' symbols. While I was trying to ...
0
votes
1answer
46 views

How authentication tag is calculated in AES-GCM-256

I have a sample code,which encrypt and decrypt a string using AES-GCM-256. I am unable to understand,how authentication tag is being generated on encrypter side and how is that being used on ...
3
votes
1answer
60 views

Question about AES-CBC IVs

I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too). As you are well aware, CBC needs an IV in order to encrypt the ...
0
votes
0answers
30 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
0
votes
1answer
38 views

PDF encryption anomaly; version 1.5 using AES

I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet ...
-1
votes
0answers
31 views

Encrypting the data in C# using Java generated RSA key (public) [closed]

Need urgent help on how to encrypt the data in C# by using JAVA generated RSA public key. PFB the information to be used as reference. Public Key: ...
3
votes
1answer
3k views

Is keystore file (server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I used to generate the .p7b file: I generated a .jks (java keystore) file using ...
2
votes
1answer
45 views

Trusting HTMLUnit with Banking Details

I figured this was a good place to learn a little about trusting libraries such as HTMLUnit with sensitive information. I want to build a service that categorises my spending, kind of like my own ...
2
votes
1answer
52 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
10
votes
1answer
208 views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
3
votes
2answers
359 views

Where should a keystore (.jks) be stored in a repository

I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
0
votes
0answers
23 views
6
votes
0answers
74 views

Why is Java disabled in Chrome? [migrated]

Why is Java disabled in Chrome? Is it some security concern? From the official Java website: Chrome no longer supports NPAPI (technology required for Java applets) The Java plug-in for web ...
1
vote
1answer
117 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
4
votes
2answers
97 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
2
votes
1answer
286 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
0
votes
0answers
107 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
3
votes
0answers
86 views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
0
votes
2answers
289 views

Creating root CA to issue certificates programatically

I have to generate a self signed root CA and use it to issue to certificates programatically. I am new to security and certificates and I think I am missing some pieces required to make the whole ...
2
votes
1answer
170 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
55
votes
5answers
175k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
1
vote
2answers
29 views

logging available client side cipher suites from Apache tomcat?

When planning to remove a cipher suite, is there a way to log what cipher suites are available to the clients that talk to my web server? The idea is to know in advance that before some cipher is ...
7
votes
3answers
326 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
0
votes
1answer
67 views

Questions regarding AES 256

i have googled and searched quite alot but most things just state the same things but not answering my questions so hopefully you guys can help me out abit Story: i am looking at creating an ...
17
votes
2answers
6k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
0
votes
0answers
17 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
2answers
55 views

What is the purpose/role of the “alias” attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
-4
votes
2answers
128 views

Java security risk? [closed]

Why is this code considered dangerous or vulnerable? String sFileName = request.getParameter("fName"); if (sFileName.toLowerCase().endsWith(".pdf")) // open file else // don’t open the file
2
votes
0answers
405 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
0
votes
0answers
34 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
1
vote
1answer
90 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
1
vote
0answers
63 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
1
vote
1answer
34 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
0
votes
1answer
143 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. I am wondering if the code signing certificate (the “final cert”) must already be in ...
1
vote
0answers
41 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
0
votes
1answer
54 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
1
vote
0answers
40 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
51 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
1
vote
2answers
134 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
3
votes
3answers
127 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
1
vote
1answer
206 views

How to disable weak cipher suits in java application server for ssl

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do ...
0
votes
1answer
96 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
2
votes
2answers
334 views

Is a browser with disabled scripts and disabled java enough against malware

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet. Of course this does not ...
3
votes
1answer
72 views

Do I put my subordinate (intermediate) or root CA certificate in my truststore?

I have a server using a certificate signed by my subordinate (intermediate) CA. My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates ...
0
votes
1answer
1k views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
0
votes
0answers
95 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...