Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

0
votes
0answers
8 views

Prevent the android app from running if packet capture or any sniffer is installed on the phone

I want to make my Android app secure. In some applications, if the phone has a network sniffer program installed(packet capture,ssl capture etc), the application gives an alert(Remove packet capture) ...
0
votes
0answers
33 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
1answer
50 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
0
votes
0answers
33 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. They are using Unmarshal as xml parser and when i try to send a post request using common xxe payloads i receive the following ...
0
votes
1answer
29 views

Storing vault read token securely

I have PCF spring boot application which needs to access the vault server to get the credentials to create datasource during startup. Right now we are hard coding the app role id and secret id in the ...
1
vote
2answers
49 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
0answers
31 views

Share generated private/public pair among instances of same application

I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
0
votes
0answers
42 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
37 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
0answers
17 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
1
vote
0answers
55 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
0
votes
0answers
17 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
-2
votes
1answer
111 views

Java Code for Pass Encryption/Decryption [closed]

I want to save an encrypted password (the encryption may be produced manually or using java code, and the encryption technique type does not matter), then the java code will read the encrypted pass ...
3
votes
1answer
82 views

What means that the same ciphersuite is both enabled and disabled in Java JSSE?

I am looking into documentation for JSSE ciphersuites in Java. https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2 ...
0
votes
1answer
61 views

Is CVE2012-5373 fixed in OpenJDK7?

Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
0
votes
1answer
47 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
1
vote
0answers
33 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
0
votes
0answers
84 views

Receiver is able to decrypt the data with private key even if sender encrypt the data with modified public key. How is it possible?

We are doing encryption/decryption in Single Sign On with SAML. We have generated self-signed public-private key pair for this. SP owns public-private key pair and shares the public key with the IDP ...
1
vote
1answer
89 views

What is the entropy of a call to java.lang.Math.random()?

Math.random() produces a double value (IEEE 754 binary64) in the range [0.0, 1.0). How many digits (or bits) of entropy does the return value of random() contain? If it simplifies things, I'm okay ...
0
votes
0answers
43 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
1
vote
1answer
78 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
0
votes
0answers
101 views

Configure burp to intercept JNLP

I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp. I read ...
1
vote
1answer
215 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
51 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
1answer
58 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
0
votes
2answers
146 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
6
votes
2answers
160 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
1answer
49 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
404 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
0
votes
0answers
436 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
1
vote
0answers
175 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
1
vote
2answers
92 views

Why does “keytool.exe” with “-certreq” arg require an alias?

I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) ...
1
vote
1answer
718 views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
1
vote
1answer
489 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
2
votes
1answer
384 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
2answers
481 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
2answers
61 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
1answer
111 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
1answer
192 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
1
vote
1answer
168 views

Which specification does Java HostnameVerifier come from?

Java HostnameVerifier defines an interface for hostname verification. Which specification does it come from? TLS or HTTPS or X509?
1
vote
1answer
145 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
0answers
51 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
1
vote
1answer
68 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
-1
votes
1answer
199 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
0
votes
1answer
296 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
0answers
47 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
1answer
209 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
1
vote
1answer
955 views

Is the JDK standard EC KeyPairGenerator suitable for use with both ECDSA and ECDH algorithms?

I've seen various references on the web for generating Elliptic Curve KeyPairs in Java, and the two most commonly referenced examples (unsurprisingly) use the JDK default provider and BouncyCastle. ...
1
vote
0answers
39 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
1
vote
1answer
736 views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...