Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

Filter by
Sorted by
Tagged with
0
votes
1answer
80 views

ZAP Proxy unable to launch browser invalid argument: can't kill an exited process

Using OWSAP ZAP 2.8.0 On Ubuntu 19.04 With openjdk version 11.0.3 installed When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
0
votes
1answer
65 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
10
votes
4answers
4k views

What are the differences of checking a self-signed certificate vs ignore it?

I'm doing an integration with a system that has a self-signed certificate. For initial development, we choose to ignore the certificate checking to bypass some errors: Exception in thread "main" ...
0
votes
0answers
23 views

One JWT with different levels of permissions

I'm using JSON Web Token's to authenticate users. I have 2 types of tokens: 1/ basic token - no expiry, includes an embedded userAccessId(which is a guid) 2/ advanced token - expiry is 5 mins, ...
1
vote
1answer
84 views

Diffie–Hellman key exchange questions [closed]

at the moment I am working on a chat application, where more than two clients can communicate at the same time. I just got started with the encryption so please be bear with me. My goal is to ...
0
votes
1answer
100 views

Is it reasonably possible to enable vulnerabilities via gadget chains?

The meta question here is that I'm trying to understand the risks to multitenant java applications from gadget chains. For example, we're all familiar with the deserialization gadget that allows the ...
0
votes
0answers
101 views

Generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...
1
vote
1answer
116 views

Is it Possible to Prevent a Physcial Attack on Server in Remote Data Center?

I've been using Amazon Web Services to run my Java application. However, due to high costs I'm looking into getting a dedicated server from Hetzner, a company based in Germany, which costs about 10-...
0
votes
1answer
103 views

Are old, unused Java SE JRE files insecure?

We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but ...
0
votes
1answer
106 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
4
votes
1answer
116 views

how much is AES GCM's security affected when not using unique IV's

I've read some articles and tutorials about AES GCM and was using this cipher for one of my java-projects, so let's say I know some basics. I read that you should use an IV-length of 12 bytes which ...
0
votes
0answers
32 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
1
vote
1answer
68 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
2
votes
2answers
161 views

Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally

Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at. I have read multiple times that ...
0
votes
0answers
54 views

Does upgrading the JVM version resolve security issues, even if I'm using an older language version?

Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (...
0
votes
1answer
87 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
0
votes
0answers
182 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
0
votes
1answer
120 views

Storing vault read token securely

I have PCF spring boot application which needs to access the vault server to get the credentials to create datasource during startup. Right now we are hard coding the app role id and secret id in the ...
1
vote
2answers
77 views

Text field exploit

If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
0
votes
0answers
48 views

Share generated private/public pair among instances of same application

I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
0
votes
0answers
52 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
39 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
0answers
23 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
1
vote
0answers
58 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
1
vote
0answers
38 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
-2
votes
1answer
239 views

Java Code for Pass Encryption/Decryption [closed]

I want to save an encrypted password (the encryption may be produced manually or using java code, and the encryption technique type does not matter), then the java code will read the encrypted pass ...
3
votes
1answer
99 views

What means that the same ciphersuite is both enabled and disabled in Java JSSE?

I am looking into documentation for JSSE ciphersuites in Java. https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2 ...
0
votes
1answer
64 views

Is CVE2012-5373 fixed in OpenJDK7?

Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
0
votes
1answer
240 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
1
vote
0answers
35 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
0
votes
0answers
133 views

Receiver is able to decrypt the data with private key even if sender encrypt the data with modified public key. How is it possible?

We are doing encryption/decryption in Single Sign On with SAML. We have generated self-signed public-private key pair for this. SP owns public-private key pair and shares the public key with the IDP ...
0
votes
1answer
102 views

What is the entropy of a call to java.lang.Math.random()?

Math.random() produces a double value (IEEE 754 binary64) in the range [0.0, 1.0). How many digits (or bits) of entropy does the return value of random() contain? If it simplifies things, I'm okay ...
0
votes
0answers
116 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
1
vote
1answer
84 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
0
votes
0answers
197 views

Configure burp to intercept JNLP

I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp. I read ...
1
vote
1answer
377 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
89 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
1answer
61 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
0
votes
2answers
386 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
6
votes
2answers
169 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
1answer
53 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
914 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
0
votes
0answers
812 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
1
vote
0answers
315 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
1
vote
2answers
121 views

Why does “keytool.exe” with “-certreq” arg require an alias?

I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) ...
2
votes
1answer
2k views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
2
votes
1answer
877 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
2
votes
1answer
590 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
2answers
887 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
2
votes
2answers
84 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...