security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

4
votes
0answers
40 views

Is java Client vulnerable by POODLE?

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7. From what I understand, to exploit POODLE you need a client ...
0
votes
0answers
12 views

How to securely implement a JAAS [on hold]

I need an example of some best practices to securely implement a login module based on JAAS ? Thanks for help.
-1
votes
1answer
41 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
0
votes
1answer
28 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
0
votes
1answer
46 views

jRAT virus on Linux

I dumbly downloaded a .jar file that contained jRAT. When run, it stalls, gives a FileNotFoundException, then crashes. When I ls'd, the jar was there. When I cd'd out and back in, the jar was gone. ...
0
votes
1answer
16 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
1
vote
3answers
57 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
0
votes
1answer
492 views

ShellShock vulnerability and Java Web Applications

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability. Can someone exploit this vulnerabiity on my website ?
0
votes
0answers
32 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
3
votes
1answer
60 views

secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please lets ...
0
votes
2answers
111 views

Can we hide a constant hashed key used for AES encryption of a password?

Are there any methods in java to hide a constant hashed key which is embedded in a class? FYI, the key is used to AES encrypt a password used to authenticate a Web Service which would only take a ...
2
votes
4answers
152 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
1
vote
1answer
58 views

Dump SSL traffic from a Java applet

I have a smartcard that can be read by websites using a Java applet (see http://www.springcard.com/online/applet_pcsc/). I would like to monitor and is to replay packets going from this java applet to ...
1
vote
1answer
59 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
2
votes
1answer
106 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
0
votes
1answer
155 views

What is the risk of installing Facebook Video Calling jar file?

I'm trying to talk with somebody on Facebook, but after many Facebook privacy scandals, it's a big question. Secondly on OSX, it's giving me the error that “FacebookVideoCalling_v1.6.jar” can’t be ...
1
vote
1answer
39 views

Developer Security Training .NET / JAVA [closed]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
-5
votes
1answer
390 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
4answers
211 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
0
votes
1answer
42 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
3
votes
1answer
933 views

Encrypting data within SQLite database in JAVA - How to store key?

So, a bit of context before I start may be handy. I am developing a JAVA desktop application which will use an SQLite database to store/process data. The application will utilize authentication to ...
1
vote
1answer
182 views

256 Bit Key into AES 128 same output as 256 Bit Key into AES 256

I have two different crypto libraries I created, one is in java and uses the standard built-in java crypto libraries. The other uses openssl and has been wrapped in java through the JNI. I'm ...
1
vote
0answers
22 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
6
votes
0answers
109 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
0
votes
0answers
33 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
2
votes
3answers
883 views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
4
votes
3answers
376 views

Protecting the Java keystore with a weak password, what's the risk?

From my understanding, the Java keystore contains certificate information, but this information is public (i.e. other machine certificates which you want the local machine to trust). Is there ...
0
votes
0answers
145 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
1answer
49 views

Is it Possible for a Java Applet to Record Cursor Movements Inside the Applet? [closed]

I am using my mouse to interact with a Java applet in a browser. Clearly the party that owns the Java applet can record where I click inside the applet. What I'm wondering about now is whether it is ...
2
votes
1answer
305 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
5
votes
5answers
243 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
1
vote
1answer
57 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
2
votes
2answers
34 views

Is there a website or other resource that lists operating systems/platforms and the included root certificates?

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one ...
1
vote
1answer
113 views

How does Java connect via SSL to a server without me providing any private/public key for the communication? [duplicate]

I am talking about server side auth only. Does Java create an internal self-signed cert for this communication? AFAIK from TLS protocol, we both need to create a shared secret, which is based on what ...
0
votes
1answer
321 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
2
votes
3answers
155 views

Are there commercially available hardware encryption devices over USB? [closed]

I'm designing a system where some combination of hardware and software (lets call it an appliance...) sends asynchronous secure archival to the cloud. By secure, I mean, AES-256 encrypted, with AES ...
2
votes
1answer
69 views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
0
votes
1answer
40 views

Executing external process from Java security

What are security implications of executing external processes using Java ProcessBuilder/Process? Example: Runtime rt = Runtime.getRuntime(); Process proc = rt.exec("processExecutable"); InputStream ...
1
vote
1answer
63 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
1
vote
1answer
72 views

Why are certain languages chosen for security application development over others?

Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier ...
1
vote
3answers
320 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
0
votes
1answer
49 views

Private and public key need to have same algorithm?

The private and the public key from the cert must have the same algorithm, correct? EDIT: Yes of course pub / priv are a key pair. So this code would be legal, to be more flexible (e.g. ECDSA or DSA): ...
3
votes
2answers
243 views

Is AES(Rijndael) faster than Blowfish?

I know theoretical that blowfish is much faster than aes. But I benchmarked several algorithms including aes and blowfish for 1MB, 5MB, 10MB etc. files in java 8 platform and bouncy castle library. In ...
0
votes
0answers
355 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
77
votes
7answers
9k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
-1
votes
1answer
75 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
1
vote
1answer
858 views

Is it safe to use localstorage to store session variables and user password? [closed]

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
2
votes
2answers
1k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
3
votes
1answer
554 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
2
votes
1answer
176 views

Auto deploy war file (backdoor/shell) to particular folder

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...