Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

1
vote
0answers
25 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
38 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
2
votes
1answer
25 views

How can Heap Pollution cause a security flaw

I came across this rule in the CERT Secure Coding Standart for Java. Heap Pollution. I understand this can cause the programm throwing an exception at runtime, but i can't understand how this could ...
3
votes
3answers
90 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
0
votes
0answers
6 views

How to disable 112 bits cipher suite in ssl of a java server [migrated]

How to disable 112 bit cipher suite on java application server. Specifically these one. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ...
1
vote
1answer
45 views

How to disable weak cipher suits in java application server for ssl

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do ...
0
votes
1answer
42 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
1
vote
0answers
14 views

Using TLS 1.2 from java 6 [migrated]

We have a legacy web application that runs in a tomcat under java 6, upgrading to 7 or 8 is infeasible as the application needs significant work to allow this and the fixes required are too large to ...
0
votes
0answers
6 views

Synchronizer token pattern [migrated]

Can any one make me clear how to generate the CSRF tokens for the request? I am using ATG Framework, and I am using DynamoHttpServletRequest pRequest and ...
3
votes
1answer
39 views

Do I put my subordinate (intermediate) or root CA certificate in my truststore?

I have a server using a certificate signed by my subordinate (intermediate) CA. My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates ...
21
votes
2answers
2k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
0
votes
0answers
38 views

JSP shell in the image on Tomcat

I have the server running Tomcat/7.0.52 under Ubuntu. I'm trying to create an image with JSP shell. I wrote the shell like this: <%@ page import="java.io.*" %> <%@ page import="java.util.*" ...
1
vote
0answers
18 views

How can I protect against cross-build injection and other dependancy management threats in Play Framework?

I am using Play Framework's inbuilt dependancy management to download a library (HTMLUnit), to do this I add the dependancy to the build.sbt file like so: libraryDependencies += ...
5
votes
2answers
201 views

How to compile java_atomicreferencearray (CVE-2012-0507) exploit to run calc.exe on system?

I got interested in java exploits and stumbled upon this: https://github.com/redcreen/exploits/tree/master/CVE-2012-0507/redcreen It is source code for Java exploit, so even though my knowledge of ...
-1
votes
1answer
35 views

Security issues for a Java program that is a consumer of streaming radio

Are there any security issues I should be aware of when opening a Socket connection with the url/port of a streaming radio station? I have written some code to do this (no web stuff, just some ...
0
votes
1answer
50 views

Application Security of crypto keys

Is there a way to secure a byte[], PrivateKey, PublicKey, KeyPair, and SecretKey in an application so that a malware would be unable to retrieve the key by analysing the memory? Or at least, how to ...
1
vote
0answers
107 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
1
vote
2answers
85 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
2
votes
1answer
29 views

Trusting HTMLUnit with Banking Details

I figured this was a good place to learn a little about trusting libraries such as HTMLUnit with sensitive information. I want to build a service that categorises my spending, kind of like my own ...
3
votes
2answers
88 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
1answer
46 views

Is there a PRNG in Java with a period of at least 256 bits?

From what I can tell, Sun JRE/JDK's are limited to only providing 128-bit strong cryptography without downloading an unlimited strength jurisdiction policy files. My question is, if I install theses ...
1
vote
0answers
63 views

How to use metasploit java exploit with custom payload?

I've been testing Java metasploit exploits on my VMs for some college assignment. I tested exploit/multi/browser/java_atomicreferencearray and it works great but with one of metasploits payloads from ...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
4
votes
1answer
108 views

How secure is my software for file encryption with AES-256?

I'm working on a project to build software for file encryption with AES in Java, it's operation is quite simple, but I was wondering if it is really safe. The program prompts the user for a ...
0
votes
1answer
78 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
1
vote
2answers
81 views

How to prevent reflected XSS with the Java Struts Framework? [closed]

I have an application that executes under Jboss server. I have an Apache server in front. My application contains a security vulnerability (XSS Cross-site scripting). I wanted to know that I had to ...
0
votes
0answers
9 views

Java card 3 connected edition availability

Why I am unable to find any Java card 3 connected edition development kit with smart cards? Does it mean that the connected edition are not manufactured by any company currently? The idea of ...
0
votes
0answers
58 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
0
votes
1answer
127 views

BLS signature java implementation needed (if possible, along with some example code)

I need to sign a string with the shortest digest possible using regular certificate like X.509. As far as I understand, I will have to transform the string to the sequence of bytes, then sign. After ...
2
votes
2answers
209 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
3
votes
0answers
229 views

Security for Hospital IT

I'm developing a program in Java intended to be utilized in a hospital. The system uses RMI internally between workstations and the server program. The program would be installed on the hospital's ...
0
votes
0answers
27 views

JAAS Authorization with OSGi

I have a custom permission called SomePermission which extends the BasicPermission class. Also I have following entry in the policy file. grant principal org.sample.jaas.pincipal.SomePrincipal ...
36
votes
8answers
4k views

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is ...
4
votes
4answers
654 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
3
votes
2answers
216 views

SSL Newbie : Does https client also need a certificate?

I am calling an https url through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words do I need my own certificate or is the ...
1
vote
0answers
37 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication ...
4
votes
2answers
91 views

Can you ever get partially decrypted data from a decryption algorithm?

I'm decrypting some data using Java and Apache's most recent WSS4J library with 128-bit AES decryption. I setup the the cipher which appears to be correct with the right padding, decryption ...
0
votes
0answers
77 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
0
votes
1answer
66 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
6
votes
1answer
99 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
3
votes
1answer
45 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone ...
0
votes
2answers
817 views

What is the best way to encrypt a json object in Java?

I have a Json array JsonArray people; which holds JSON objects representing people. Currently I am saving them as plaintext in a json file. try { OutputStream out = new ...
4
votes
0answers
679 views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
2
votes
0answers
45 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
2
votes
2answers
83 views

Java code signing vs. sandboxing

I'm trying to understand the rationale behind Java Applet development these past few years. Back in the old days, most Applets were unsigned, and the code for these was run in a sandbox where barring ...
1
vote
1answer
100 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
1answer
121 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
2
votes
1answer
30 views

SSL with both local client and server

I'm not sure whether this topic belongs in Cryptography, Programming or StackOverFlow so please forgive me if I don't add a useful question to this site. I want to give both server and client ...
2
votes
1answer
151 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
0
votes
0answers
40 views

Missing link between Java javax.smartcardio and OpenPGP functionality

As I understand, Yubikey NEO in CCID mode can be used as a SmartCard. I connected it, configured using GnuPG and tested using Kleopatra: encrypted a text file. Is it possible to encrypt data with ...