Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

0
votes
0answers
38 views

Spring Session management

I want to implement a simple session management on spring security for local project. I have a login form, some URLs for user functions, an interceptor,a controller and also an authenticator and ...
2
votes
1answer
65 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
2answers
62 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
1answer
38 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
1answer
38 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
0answers
18 views

Anonymous login for a web browser client

I have inherited a simple single page web app. Users do not log in - once they have the URL they can browse the (very simple) app. The app communicates with a Java API. Just some background: the app ...
0
votes
1answer
37 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
1
vote
1answer
19 views

Which specification does Java HostnameVerifier come from?

Java HostnameVerifier defines an interface for hostname verification. Which specification does it come from? TLS or HTTPS or X509?
1
vote
1answer
105 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
0answers
36 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
1
vote
1answer
60 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
-1
votes
1answer
72 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
0
votes
1answer
80 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
0answers
34 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
1answer
185 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
1
vote
1answer
67 views

Is the JDK standard EC KeyPairGenerator suitable for use with both ECDSA and ECDH algorithms?

I've seen various references on the web for generating Elliptic Curve KeyPairs in Java, and the two most commonly referenced examples (unsurprisingly) use the JDK default provider and BouncyCastle. ...
1
vote
0answers
29 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
1
vote
0answers
305 views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
0
votes
1answer
59 views

Oracle instance with embedded older version of Java within its directories flagged with numerous vulnerabilities

The issue is an Oracle instance with embedded older versions of Java within the Oracle directories that are being flagged with numerous vulnerabilities. Installing the April 2018 Oracle Java patch ...
0
votes
0answers
36 views

Extract public and private keys from JBOSS [duplicate]

Our sysadmin is requiring that I provide the with the public and private key for a standalone Jboss sever. I find a file "keystore" in wildfly-10.1.0.Final/standalone/configuration Using [...
2
votes
0answers
52 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
1
vote
0answers
101 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
1
vote
1answer
233 views

diffie-hellman size 2048 and key with size 1024

I want to increase the security of my Tomcat and to configure diffie-hellman module size 2048. I want to add to my CATALINA_OPTS -Djdk.tls.ephemeralDHKeySize=2048 What happens if I have configured it ...
1
vote
1answer
160 views

How to perform taint analysis on Java source code? [closed]

I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java ...
0
votes
0answers
18 views

Security of Java apps in Windows

Once upon a time, I would always keep the latest Java Runtime Environment (JRE) installed in Windows. But after numerous security issues with JRE, and due to an updater that had issues, I decided to ...
0
votes
0answers
15 views

What are the impacts of skipping the hostname verification during the handshake? [duplicate]

What are the possible impacts of not checking the hostname during the handshake in a client application (written in java) when connecting to a service? What is required to exploit this issue? ...
0
votes
0answers
181 views

XSS Filter Input validation failure potential vulnerability?

I was testing an XSS filter of a java-based web server. Most everything was escaped, but when I typed \\" (backslash backslash double quote), the system threw an error, "Input validation failure". ...
2
votes
1answer
76 views

How should Two Applications Authenticate between each other

I would like to understand which would be the best strategy for authentication between two applications running at different places. My application client needs to call the Rest API of a server, and ...
0
votes
0answers
41 views

how to increase security on server on the key to access the keystore, when the key must be included on code? [duplicate]

I'm programming on java and accesing a keystore for public and private keys. I'm using them for strong text encryption to save on my servers. How can I increase security on the weakest link, the ...
2
votes
1answer
186 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
322 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
6
votes
1answer
3k views

Sending password from client app to server with Java

I'm developing an application that requires a user to login. On the server side I'm using the PBKDF2 algorithm to hash passwords, but currently I'm sending passwords to the server as a plain text ...
0
votes
1answer
369 views

How to prevent users from retrieving the Java source code from a jar/exe file that I am distributing openly? [duplicate]

I guess Java jar files can be reversed back to the source code and I want to prevent it from happening that easily. What I did was to convert the jar file into a Windows native exe file using launch4j....
3
votes
0answers
146 views

Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?

We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
10
votes
5answers
1k views

Generating and securing gift card codes

I'm working for a company that is generating gift card codes which can be used to pay for goods on online stores. I'm wondering what the most secure way of generating these gift card codes are. The ...
0
votes
0answers
73 views

Accessing MySQL DB from Java App or Apache Kafka and NiFi

I am wondering, what is more secure to access a database in MySQL: directly via Java application (DriverManager.getConnection) send information from Java App to Apache Kafka, then read it out in ...
0
votes
0answers
294 views

Android: Can you exploit a broadcast Receiver that receives a custom object from the intent?

The app I am trying to attack (under a legitimate bug bounty program of course) has the following code for its broadcast receiver: //From vulnerable app public void onReceive(Context paramContext, ...
2
votes
1answer
242 views

How StandardPBEStringEncryptor works?

I have to encrypt some String data and be able to decrypt them. So i tried Java simplified encryption (Jasypt), i used StandardPBEStringEncryptor. It works i can encrypt and decrypt, but i don't ...
2
votes
1answer
282 views

Webgoat missing function level access control lesson

I've recently installed WebGoat 8.00M12 on my computer and I tried to solve the "Access Control" section for a demonstration in my class. Everything was simple and smooth till I got stuck at the last ...
1
vote
2answers
367 views

How to securely send a password from one app to another app?

See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable? I am a Java developer that is building an app where ...
1
vote
1answer
2k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
1
vote
1answer
76 views

When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?

I am a Java developer that is building an app where it needs to call a C# process from within. In my situation, the Java app is calling this C# program https://github.com/nddipiazza/...
2
votes
1answer
459 views

Does Java anti-decompiler software really work as claimed?

BIS Guard's Java Antidecompiler is an application that you can purchase that claims: Java Antidecompiler protects java byte-code against decompilers, any binary viewers/editors, prevents reverse ...
0
votes
0answers
25 views

What is the default keysize and hashing algorithm and encryption algo used by default in JDK 8?

What is the default keysize and hashing algorithm and encryption algo used by default in JDK 8 ? how to determine what is used by application ?
3
votes
1answer
501 views

Unrestricted File upload [closed]

I am working on a file upload feature in our app. Users can also download uploaded files from the app. To prevent malicious file upload, I am checking magic bytes of the file to find the file type ...
0
votes
2answers
2k views

How to import plain public key into java keystore?

I want to import a lone public key (.pem) into a Java keystore (.jks). I don't have the private key. As I understand, the public key must be wrapped as a certificate, so that I can import it into a ...
1
vote
0answers
987 views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
1
vote
1answer
613 views

How does ProcessBuilder avoid OS command injection?

while I understand that OS command injection needs to have the untrusted input to be validated, I see that people have been suggesting to use ProcessBuilder(...).start() over Runtime.getRuntime().exec(...
3
votes
1answer
43 views

CVE Description - Does impacted supported version mean specific version and older?

I needed guidance on how to interpret Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. The above phrase is from CVE-...
2
votes
1answer
106 views

Is supporting older version of Java dangerous

We have a code library that is used by developers and requires using Java 1.8. However, there have been requests to support 1.7 and it would be trivial to do so. The library is basically a Java ...