New answers tagged


The reasoning might have been that ResultSet.getString and RestulSet.getObject should return a valid result no matter what the underlying value is for the column you specify. So if there was an SQLi attack and column 1 is usually a string but is now some secret number you'll get still a valid result and thus leak information about that result. Whereas ...


Minor ranting This is a bit broad, and there may be some that are unknown at present, but there's usually good references out there if you're willing to search for them. Code execution isn't the only problem. You want to be careful of things that can lead to code execution. However, and as always, it's important to study these functions to see what ...


Very unlikely to happen, but possible: If some programmers mishandle an unchecked warning throwing a ClassCastException by casting some unsigned integer values into signed integer that could easily allow an attacker to bypass Integer.MIN_VALUE and Integer.MAX_VALUE into an integer overflow attack.


If you enable SSL/TLS on the server side, the client has to be able to "speak SSL/TLS" too. Otherwise, the connection will end up being reset. Just changing a web-service to use "https" does not auto-magically change all applications communication encrypted. This is a shared protocol. If I suddenly goes speaking French but you only understand English, ...


If you configure the server to redirect HTTP to HTTPS, you shouldn't need to modify the application code whatsoever (assuming it will follow a redirect). However, when the request is first made, it will not be encrypted. An attacker could man-in-the-middle or passively sniff the connection in order to read request data or even prevent it from redirecting to ...


Just because you add https to your web server does not mean that you have to remove http. For example, this very page is available both over http, and over https. While it's certainly a good idea to migrate your Android app to use https, you don't have to do it right away: offer both!


JAVA allows cipher suites to be removed/excluded from use in the security policy file called that’s located in your JRE: $PATH/[JRE]/lib/security The jdk.tls.disabledAlgorithms property in the policy file controls TLS cipher selection. The jdk.certpath.disabledAlgorithms controls the algorithms you will come across in SSL certificates. Oracle ...


It is the last block of Hex from the following command: openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs -text


You say: My initial thought is that it has to receive this certificate from a CA, as if it receives it from the server, it may be fraudulent. Yet, here lies the problem with your thinking: X.509 certificates are crafted such that they are tamper resistant. If the server changes the certificate, it get's invalid (with acceptable probabitity). You can ...

Top 50 recent answers are included