The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

Filter by
Sorted by
Tagged with
1
vote
0answers
63 views

Bypass prepared statements?

I know that prepared statements are used to handle input at the front end. However I was wondering how do you bypass a prepared statement? I have seen some people talk about string concentration but I’...
0
votes
2answers
72 views

Can I trust that the Java CVE's contain only the affected versions?

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that ...
1
vote
0answers
49 views

How do I login silently to multiple web applications without user being interrupted to keep their sessions active [migrated]

We need to login to 20 - 30 different web applications and enter credentials to keep user active throughout the day. This needs to happen in the background on user's machine without user being ...
1
vote
1answer
44 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
2
votes
0answers
47 views

How to store a key for a Java app server?

Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
0
votes
0answers
29 views

How to customize default enabled EC curves or the curves preference in Azul Zulu JDK

We use Zulu JDK and want to customize the default enabled EC curves. Oracle JRE provides this using jdk.tls.namedGroups system property in java.security. https://www.oracle.com/technetwork/java/...
1
vote
1answer
60 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
0
votes
0answers
37 views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
0
votes
1answer
124 views

What is the following regex trying to protect against?

I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm ...
0
votes
1answer
186 views

ZAP Proxy unable to launch browser invalid argument: can't kill an exited process

Using OWSAP ZAP 2.8.0 On Ubuntu 19.04 With openjdk version 11.0.3 installed When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
0
votes
1answer
93 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
11
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
0
votes
0answers
23 views

One JWT with different levels of permissions

I'm using JSON Web Token's to authenticate users. I have 2 types of tokens: 1/ basic token - no expiry, includes an embedded userAccessId(which is a guid) 2/ advanced token - expiry is 5 mins, ...
1
vote
1answer
104 views

Diffie–Hellman key exchange questions [closed]

at the moment I am working on a chat application, where more than two clients can communicate at the same time. I just got started with the encryption so please be bear with me. My goal is to ...
0
votes
1answer
102 views

Is it reasonably possible to enable vulnerabilities via gadget chains?

The meta question here is that I'm trying to understand the risks to multitenant java applications from gadget chains. For example, we're all familiar with the deserialization gadget that allows the ...
0
votes
0answers
108 views

Generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...
1
vote
1answer
153 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
0
votes
1answer
111 views

Are old, unused Java SE JRE files insecure?

We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but ...
0
votes
1answer
146 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
4
votes
1answer
120 views

how much is AES GCM's security affected when not using unique IV's

I've read some articles and tutorials about AES GCM and was using this cipher for one of my java-projects, so let's say I know some basics. I read that you should use an IV-length of 12 bytes which ...
0
votes
0answers
36 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
1
vote
1answer
129 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
2
votes
2answers
229 views

Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally

Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at. I have read multiple times that ...
0
votes
0answers
55 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
1answer
153 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
0
votes
0answers
202 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
0
votes
1answer
180 views

Storing vault read token securely

I have PCF spring boot application which needs to access the vault server to get the credentials to create datasource during startup. Right now we are hard coding the app role id and secret id in the ...
1
vote
2answers
123 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
0answers
49 views

Share generated private/public pair among instances of same application

I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
0
votes
0answers
52 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
39 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
0answers
23 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
1
vote
0answers
58 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
1
vote
0answers
44 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
-2
votes
1answer
291 views

Java Code for Pass Encryption/Decryption [closed]

I want to save an encrypted password (the encryption may be produced manually or using java code, and the encryption technique type does not matter), then the java code will read the encrypted pass ...
3
votes
1answer
114 views

What means that the same ciphersuite is both enabled and disabled in Java JSSE?

I am looking into documentation for JSSE ciphersuites in Java. https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2 ...
0
votes
1answer
64 views

Is CVE2012-5373 fixed in OpenJDK7?

Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
0
votes
1answer
335 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
1
vote
0answers
35 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
0
votes
0answers
145 views

Receiver is able to decrypt the data with private key even if sender encrypt the data with modified public key. How is it possible?

We are doing encryption/decryption in Single Sign On with SAML. We have generated self-signed public-private key pair for this. SP owns public-private key pair and shares the public key with the IDP ...
0
votes
1answer
104 views

What is the entropy of a call to java.lang.Math.random()?

Math.random() produces a double value (IEEE 754 binary64) in the range [0.0, 1.0). How many digits (or bits) of entropy does the return value of random() contain? If it simplifies things, I'm okay ...
1
vote
1answer
85 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
1
vote
1answer
416 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
1
vote
1answer
103 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
1answer
62 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
0
votes
2answers
485 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
6
votes
2answers
172 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
1answer
56 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
1k views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
0
votes
0answers
981 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...