security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

0
votes
3answers
98 views

Java AES encryption output length

I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted. In Java AES encryption, if ...
1
vote
1answer
75 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
1
vote
1answer
115 views

Auto deploy war file (backdoor/shell) to particular folder

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
1
vote
1answer
1k views

Uploading JSP (Any kind of java code) to Tomcat without manager

I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34. I'm doing a penetration testing of a java website and found it's ...
-1
votes
1answer
68 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
4
votes
0answers
64 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
2
votes
0answers
97 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
1
vote
0answers
77 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
1
vote
0answers
120 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
1
vote
0answers
58 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
51 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
0
votes
0answers
18 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
0
votes
0answers
103 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
0answers
159 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...