Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

0
votes
1answer
50 views

Is CVE2012-5373 fixed in OpenJDK7?

Can anyone please tell me if CVE2012-5373 is fixed in OpenJDK7? I have searched for the fix details, but I couldn't find any.
0
votes
1answer
25 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
1
vote
0answers
31 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
0
votes
0answers
45 views

Receiver is able to decrypt the data with private key even if sender encrypt the data with modified public key. How is it possible?

We are doing encryption/decryption in Single Sign On with SAML. We have generated self-signed public-private key pair for this. SP owns public-private key pair and shares the public key with the IDP ...
1
vote
1answer
82 views

What is the entropy of a call to java.lang.Math.random()?

Math.random() produces a double value (IEEE 754 binary64) in the range [0.0, 1.0). How many digits (or bits) of entropy does the return value of random() contain? If it simplifies things, I'm okay ...
0
votes
0answers
30 views

Exploit web applet uploading jar through jnlp file

I have a web application which at its start asks the users to download and execute a jnlp file. The jnlp file has the following structure: <?xml version="1.0" encoding="UTF-8"?> <jnlp spec=...
0
votes
0answers
20 views

Java http proxy burp

I have a web application which downloads and executes a jnlp file to launch an applet. Using javaws I set a proxy under the network settings at 127.0.0.1 port 8080. Is this enough to monitor through ...
1
vote
1answer
77 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
0
votes
0answers
59 views

Configure burp to intercept JNLP

I am monitoring a site where there is an applet. To use it, there is the download and the execution of a jnlp file. I would like to monitor the requests made from and to that file through Burp. I read ...
1
vote
1answer
122 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
45 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
1answer
57 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
0
votes
2answers
76 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
6
votes
2answers
145 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
1
vote
1answer
46 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
208 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
0
votes
0answers
246 views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
1
vote
0answers
97 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
1
vote
2answers
85 views

Why does “keytool.exe” with “-certreq” arg require an alias?

I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) ...
1
vote
1answer
291 views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
1
vote
1answer
313 views

How to disable the use of HTTP verb tunneling using HTTP headers or query parameters?

The attacker request uses a trusted HTTP verb such as GET or POST, but adds request headers such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, or a query parameter such as _method to ...
2
votes
1answer
264 views

What *actually* is a Java applets vulnerability?

When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component? what exactly is exploited?
1
vote
2answers
260 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
1
vote
2answers
53 views

Should you use SecureRandom.getInstance() with or without a provider?

So, I am new to cryptography and I was learning about SecureRandom and all of the ways it calls implementations with or without providers. When I looked up some sites for information, it says not to ...
1
vote
1answer
80 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
1answer
142 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
1
vote
1answer
103 views

Which specification does Java HostnameVerifier come from?

Java HostnameVerifier defines an interface for hostname verification. Which specification does it come from? TLS or HTTPS or X509?
1
vote
1answer
138 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
0answers
50 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
1
vote
1answer
68 views

Could this list of ciphersuites be improved on?

During my self-teaching about trying to find mobile application vulnerabilities, I found a list of cipher suites that are/were considered insecure: md5 sha1 sha-1 md4 rc4 des tripledes 3des If I ...
-1
votes
1answer
138 views

Exploitation With Java

I was wondering if it is possible to write exploits in java. The Eternalblue exploit can be written in perl, ruby and even python but is it possible to write it in java? I don't see any suitable ...
0
votes
1answer
251 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
0answers
47 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
1answer
201 views

Is hiding my Java desktop app inside a VM the best way to protect my Java source code?

I need to distribute a Java desktop app to the user. I am looking at different ways to protect my source code from reverse engineering. One method is to distribute a Virtual Machine (says Linux) ...
1
vote
1answer
551 views

Is the JDK standard EC KeyPairGenerator suitable for use with both ECDSA and ECDH algorithms?

I've seen various references on the web for generating Elliptic Curve KeyPairs in Java, and the two most commonly referenced examples (unsurprisingly) use the JDK default provider and BouncyCastle. ...
1
vote
0answers
35 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
1
vote
0answers
560 views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
-1
votes
0answers
55 views

Extract public and private keys from JBOSS [duplicate]

Our sysadmin is requiring that I provide the with the public and private key for a standalone Jboss sever. I find a file "keystore" in wildfly-10.1.0.Final/standalone/configuration Using [...
2
votes
0answers
102 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
1
vote
0answers
173 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
1
vote
1answer
530 views

diffie-hellman size 2048 and key with size 1024

I want to increase the security of my Tomcat and to configure diffie-hellman module size 2048. I want to add to my CATALINA_OPTS -Djdk.tls.ephemeralDHKeySize=2048 What happens if I have configured it ...
1
vote
1answer
258 views

How to perform taint analysis on Java source code? [closed]

I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java ...
0
votes
0answers
22 views

Security of Java apps in Windows

Once upon a time, I would always keep the latest Java Runtime Environment (JRE) installed in Windows. But after numerous security issues with JRE, and due to an updater that had issues, I decided to ...
0
votes
0answers
19 views

What are the impacts of skipping the hostname verification during the handshake? [duplicate]

What are the possible impacts of not checking the hostname during the handshake in a client application (written in java) when connecting to a service? What is required to exploit this issue? ...
0
votes
0answers
271 views

XSS Filter Input validation failure potential vulnerability?

I was testing an XSS filter of a java-based web server. Most everything was escaped, but when I typed \\" (backslash backslash double quote), the system threw an error, "Input validation failure". ...
2
votes
1answer
92 views

How should Two Applications Authenticate between each other

I would like to understand which would be the best strategy for authentication between two applications running at different places. My application client needs to call the Rest API of a server, and ...
0
votes
0answers
41 views

how to increase security on server on the key to access the keystore, when the key must be included on code? [duplicate]

I'm programming on java and accesing a keystore for public and private keys. I'm using them for strong text encryption to save on my servers. How can I increase security on the weakest link, the ...
2
votes
1answer
280 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
463 views

Android anti-tampering and SSL pinning bypass solid implementation [duplicate]

Is there any advance solution for Android application anti-tampering and bulletproof obfuscation implementation? I have been already using following protections in my application: Obsufcation using ...
6
votes
1answer
3k views

Sending password from client app to server with Java

I'm developing an application that requires a user to login. On the server side I'm using the PBKDF2 algorithm to hash passwords, but currently I'm sending passwords to the server as a plain text ...