Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

0
votes
0answers
40 views

Analyzing CRLF Vulnerability on a Log statement logging Exception

Veracode is reported a CRLF injection vulnerability on this particular line in my code: log.error(exception); Below is the complete method: ErrorResponse getErrorResponse(final Exception exception)...
0
votes
0answers
18 views

Which third-party solution for authorisation in desktop java software

Let's say I have a java software that I distribute on my website. the user creates an account on my website (login + passwords) and buys a temporary access to my software. the account is in fact ...
0
votes
0answers
17 views

Smart Cards with ECC functionalities and unextrectable private keys

I have recently started to look into smart cards with ECC features. Basically, I want to have a Java Card that can calculate ECC signatures and provides some security guarantees that the key used for ...
0
votes
0answers
16 views

Why would someone practically want access to a JSP servlet source?

I've seen online now a few times ways to exploit web servers like httpd using connectors like tomcat to expose the source code for a .jsp file when it is not supposed to. For example, appending %01 ...
2
votes
1answer
55 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
0
votes
1answer
30 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
1
vote
0answers
31 views

How to sign a .jar file using XMSS (PQC) Signature Scheme with JarSigner

I am trying to use JarSigner to sign .jar files with XMSS Signatures. With the use of the JCA/JCE Post-Quantum Cryptography Provider from BouncyCastle it is possible to generate XMSS and XMSSMT ...
6
votes
2answers
131 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
0
votes
0answers
29 views

Is uploading to Maven Central a plausible vector of attack?

Is Maven a plausible vector of attack? Discusses Maven Central as a method of attack, but the answers assume MITM, or attacking a known library uploaded to Maven Central from the outside. Either ...
1
vote
1answer
40 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
86 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
0
votes
0answers
22 views

Can malicious .jar running in Hyper-V VM affect the host system? [duplicate]

There are a lot of physics simulations over the internet which require Java to run. They are .jar or .jnlp. I'd like to use them but I'm afraid of security issues in JRE and I think to use a VM. My ...
0
votes
0answers
66 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
1
vote
0answers
47 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
0
votes
0answers
61 views

javax.xml.* XXE Exploitation

During a pentest engagement, I found an XXE vulnerability on a SOAP webservice written in Java, OS is Windows Server and I'm trying to demonastrate how serious the vulnerability is. The problem is, I ...
1
vote
2answers
81 views

Why does “keytool.exe” with “-certreq” arg require an alias?

I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) ...
1
vote
1answer
74 views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
1
vote
1answer
141 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
2
votes
1answer
123 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
2answers
99 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
2answers
49 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
1answer
48 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
0answers
20 views

Anonymous login for a web browser client

I have inherited a simple single page web app. Users do not log in - once they have the URL they can browse the (very simple) app. The app communicates with a Java API. Just some background: the app ...
0
votes
1answer
87 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
1
vote
1answer
52 views

Which specification does Java HostnameVerifier come from?

Java HostnameVerifier defines an interface for hostname verification. Which specification does it come from? TLS or HTTPS or X509?
1
vote
1answer
120 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
0answers
48 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
1
vote
1answer
64 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
-1
votes
1answer
93 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
0
votes
1answer
166 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
0answers
40 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
1answer
190 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
1
vote
1answer
229 views

Is the JDK standard EC KeyPairGenerator suitable for use with both ECDSA and ECDH algorithms?

I've seen various references on the web for generating Elliptic Curve KeyPairs in Java, and the two most commonly referenced examples (unsurprisingly) use the JDK default provider and BouncyCastle. ...
1
vote
0answers
31 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
1
vote
0answers
446 views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
0
votes
1answer
82 views

Oracle instance with embedded older version of Java within its directories flagged with numerous vulnerabilities

The issue is an Oracle instance with embedded older versions of Java within the Oracle directories that are being flagged with numerous vulnerabilities. Installing the April 2018 Oracle Java patch ...
0
votes
0answers
43 views

Extract public and private keys from JBOSS [duplicate]

Our sysadmin is requiring that I provide the with the public and private key for a standalone Jboss sever. I find a file "keystore" in wildfly-10.1.0.Final/standalone/configuration Using [...
2
votes
0answers
71 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
1
vote
0answers
140 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
1
vote
1answer
389 views

diffie-hellman size 2048 and key with size 1024

I want to increase the security of my Tomcat and to configure diffie-hellman module size 2048. I want to add to my CATALINA_OPTS -Djdk.tls.ephemeralDHKeySize=2048 What happens if I have configured it ...
1
vote
1answer
217 views

How to perform taint analysis on Java source code? [closed]

I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java ...
0
votes
0answers
22 views

Security of Java apps in Windows

Once upon a time, I would always keep the latest Java Runtime Environment (JRE) installed in Windows. But after numerous security issues with JRE, and due to an updater that had issues, I decided to ...
0
votes
0answers
16 views

What are the impacts of skipping the hostname verification during the handshake? [duplicate]

What are the possible impacts of not checking the hostname during the handshake in a client application (written in java) when connecting to a service? What is required to exploit this issue? ...
0
votes
0answers
225 views

XSS Filter Input validation failure potential vulnerability?

I was testing an XSS filter of a java-based web server. Most everything was escaped, but when I typed \\" (backslash backslash double quote), the system threw an error, "Input validation failure". ...
2
votes
1answer
80 views

How should Two Applications Authenticate between each other

I would like to understand which would be the best strategy for authentication between two applications running at different places. My application client needs to call the Rest API of a server, and ...
0
votes
0answers
41 views

how to increase security on server on the key to access the keystore, when the key must be included on code? [duplicate]

I'm programming on java and accesing a keystore for public and private keys. I'm using them for strong text encryption to save on my servers. How can I increase security on the weakest link, the ...
2
votes
1answer
233 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
403 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
6
votes
1answer
3k views

Sending password from client app to server with Java

I'm developing an application that requires a user to login. On the server side I'm using the PBKDF2 algorithm to hash passwords, but currently I'm sending passwords to the server as a plain text ...
0
votes
1answer
476 views

How to prevent users from retrieving the Java source code from a jar/exe file that I am distributing openly? [duplicate]

I guess Java jar files can be reversed back to the source code and I want to prevent it from happening that easily. What I did was to convert the jar file into a Windows native exe file using launch4j....