Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

3
votes
0answers
16 views

Does Oracle's GuardedString protect sensitive data against heap or memory dumps?

Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation: The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by ...
1
vote
1answer
36 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
0
votes
0answers
11 views

How do I perform output encoding on text boxes having limited sizes? [closed]

How do I apply output encoding for a text box which only allows a limited size? I cannot perform input validation for that text box because it expects '<' and '>' symbols. While I was trying to ...
0
votes
0answers
30 views

Java Exploits - Not using the browser plugin

I'm looking for examples of Java exploits that do not leverage the Java browser plug-in/Browser applet to run. For example: Drive-by downloads that download a Java file that is run by the JRE but ...
3
votes
1answer
60 views

Question about AES-CBC IVs

I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too). As you are well aware, CBC needs an IV in order to encrypt the ...
-1
votes
0answers
31 views

Encrypting the data in C# using Java generated RSA key (public) [closed]

Need urgent help on how to encrypt the data in C# by using JAVA generated RSA public key. PFB the information to be used as reference. Public Key: ...
0
votes
1answer
38 views

PDF encryption anomaly; version 1.5 using AES

I'm not sure if this is the correct forum to ask this question so please accept my apologies in advance if this is the wrong place. (I have already posted this in the Programmers section but I've yet ...
0
votes
0answers
23 views

Can some (Java) virus run everywhere (Windows, Linux, Mac)? [duplicate]

That's what Java, for example, is for, write once run everywhere.
6
votes
0answers
74 views

Why is Java disabled in Chrome? [migrated]

Why is Java disabled in Chrome? Is it some security concern? From the official Java website: Chrome no longer supports NPAPI (technology required for Java applets) The Java plug-in for web ...
3
votes
0answers
86 views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
1
vote
2answers
29 views

logging available client side cipher suites from Apache tomcat?

When planning to remove a cipher suite, is there a way to log what cipher suites are available to the clients that talk to my web server? The idea is to know in advance that before some cipher is ...
0
votes
1answer
67 views

Questions regarding AES 256

i have googled and searched quite alot but most things just state the same things but not answering my questions so hopefully you guys can help me out abit Story: i am looking at creating an ...
0
votes
1answer
46 views

How authentication tag is calculated in AES-GCM-256

I have a sample code,which encrypt and decrypt a string using AES-GCM-256. I am unable to understand,how authentication tag is being generated on encrypter side and how is that being used on ...
0
votes
0answers
17 views

Securing FTP Creds in a Java Open Source API

I've written a basic Java API and source code must be released to a small community for the application to function correctly. The Java API helps developers track data for their running scripts and ...
0
votes
2answers
55 views

What is the purpose/role of the “alias” attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
-4
votes
2answers
128 views

Java security risk? [closed]

Why is this code considered dangerous or vulnerable? String sFileName = request.getParameter("fName"); if (sFileName.toLowerCase().endsWith(".pdf")) // open file else // don’t open the file
10
votes
1answer
208 views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
0
votes
0answers
34 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
1
vote
1answer
91 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
1
vote
0answers
65 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
4
votes
2answers
98 views

Google OAuth 2.0 and Java. Is it safe to locally store access tokens?

I Installed this Java app: https://github.com/andresoviedo/google-drive-ftp-adapter The program asks permission to see my Google-Drive files and then stores an access-token on my local harddisk. ...
1
vote
1answer
34 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
1
vote
0answers
41 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
1
vote
0answers
40 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
51 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
2
votes
1answer
52 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
3
votes
3answers
127 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
1
vote
1answer
207 views

How to disable weak cipher suits in java application server for ssl

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do ...
0
votes
1answer
96 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
3
votes
1answer
72 views

Do I put my subordinate (intermediate) or root CA certificate in my truststore?

I have a server using a certificate signed by my subordinate (intermediate) CA. My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
0
votes
0answers
95 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
0answers
21 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += "net.sourceforge....
7
votes
3answers
326 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
-1
votes
1answer
41 views

Security issues for a Java program that is a consumer of streaming radio

Are there any security issues I should be aware of when opening a Socket connection with the url/port of a streaming radio station? I have written some code to do this (no web stuff, just some Swing/...
0
votes
1answer
54 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
1
vote
0answers
110 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
2answers
95 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
2
votes
1answer
45 views

Trusting HTMLUnit with Banking Details

I figured this was a good place to learn a little about trusting libraries such as HTMLUnit with sensitive information. I want to build a service that categorises my spending, kind of like my own ...
3
votes
2answers
132 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
1answer
52 views

Is there a PRNG in Java with a period of at least 256 bits?

From what I can tell, Sun JRE/JDK's are limited to only providing 128-bit strong cryptography without downloading an unlimited strength jurisdiction policy files. My question is, if I install theses ...
1
vote
1answer
117 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
4
votes
1answer
143 views

How secure is my software for file encryption with AES-256?

I'm working on a project to build software for file encryption with AES in Java, it's operation is quite simple, but I was wondering if it is really safe. The program prompts the user for a ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
1
vote
2answers
127 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
0
votes
0answers
12 views

Java card 3 connected edition availability

Why I am unable to find any Java card 3 connected edition development kit with smart cards? Does it mean that the connected edition are not manufactured by any company currently? The idea of ...
0
votes
0answers
91 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
0
votes
1answer
192 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
2
votes
2answers
274 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...