Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

97 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
1 answer
4k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
Shurmajee's user avatar
  • 7,457
6 votes
0 answers
2k views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
Jyosk Natalm's user avatar
4 votes
1 answer
9k views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
dFrancisco's user avatar
  • 2,721
4 votes
0 answers
2k views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
DarkMantis's user avatar
4 votes
0 answers
926 views

What is the openssl equivalent of using java's KeyPairGenerator?

I have been using java's KeyPairGenerator in order to generate public/private keys within a program so that I can encrypt and decrypt files(also using java encrypt/decrypt methods). I want to be able ...
void.massive's user avatar
4 votes
0 answers
3k views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
KM.'s user avatar
  • 161
3 votes
0 answers
1k views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
Waristea's user avatar
3 votes
0 answers
648 views

How to set Secure attribute to csfcfc cookie in Glassfish?

After a vulnerabilities scan, I found that the csfcfc cookie does not have the Secure attribute. JSESSIONID has httpOnly and Secure attributes. Is there a way to force it? I found an answer for JBoss ...
WaLinke's user avatar
  • 131
3 votes
0 answers
159 views

Custom keystore/certificate to hold asymmetric (RSA) keys

My app will require maintaining an RSA keypair locally on the user's machine. I was a bit disappointed to discover that PKCS#12 and JKS don't offer higher than 3DES (correct me if I have this wrong). ...
0zero's user avatar
  • 53
2 votes
0 answers
435 views

Does Java cache intermediate certificates fetched via AIA?

Java supports AIA chasing via the system property com.sun.security.enableAIAcaIssuers (which is disabled per default). There is some documentation available but it is pretty slim regarding details. I ...
mss's user avatar
  • 131
2 votes
0 answers
149 views

Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?

Although What is the best way to store password in memory (RAM) in Java? covers the same territory, this question has the aspect of noticing what other people do and wondering why. The question on SO:...
David Bullock's user avatar
2 votes
0 answers
511 views

Zip Slip path traversal and consistent vulnerability checks

According to multiple sources such as snyk and infoq, preventing a "Zip Slip" vulnerability in Java can be achieved by denying writes outside the target directory: String ...
mrucci's user avatar
  • 121
2 votes
0 answers
232 views

Java - Ultra Light Client (ULC traffic inspection)

I'm working on security assessment of thick client application created using ULC. It is black box approach. Based on wiki (wiki.c2.com): "Ultra Light Client (ULC) for Java is a widget set that ...
poule's user avatar
  • 21
2 votes
0 answers
359 views

Is it safe to generate a temporary API key from a random generator seeded by a secure random generator?

I have a need to generate a key consisting of a given number of random characters that will be used to access resources via a public API. It should not be possible to predict the key. This is done in ...
G_H's user avatar
  • 121
2 votes
0 answers
148 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
microwth's user avatar
  • 2,473
2 votes
0 answers
862 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
Jae Bin's user avatar
  • 21
2 votes
0 answers
470 views

How to use JAXB Custom Mapping to whitelist classes instantiatable over XML

Known vulnerabilities associated with JAXB unmarshalling are: XXE billion laughs RCE which are due to deserialization of untrusted data and the resolution of external references. I'm aware of the ...
iammyr's user avatar
  • 41
2 votes
0 answers
205 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
maple_shaft's user avatar
  • 1,092
2 votes
0 answers
564 views

Simple private AKKA encryption certs

There are several questions on stackoverflow regarding Akka, SSL and certificate management to enable secure (encrypted) peer to peer communication between Akka actors. The Akka documentation on ...
Jeff Steinmetz's user avatar
2 votes
0 answers
193 views

Do different JVMS implement the same transformation differently?

I have encrypted a string - "EXAMPLE" on Oracle JDK 1.7 using the following code //ENCRYPTION of "EXAMPLE" byte[] clearText = {69, 88, 65, 77, 80, 76, 69}; KeyPair keyPair = EncodingTest....
rmurali's user avatar
  • 21
2 votes
0 answers
1k views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
Destruktor's user avatar
2 votes
0 answers
662 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
Pawel Veselov's user avatar
2 votes
0 answers
174 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
makerofthings7's user avatar
2 votes
0 answers
192 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
Flavio's user avatar
  • 121
1 vote
0 answers
76 views

Google Login with idToken and JWT (Java)

We are integrating Google login in our app and we intend to use the idToken for authentication. We are already sending the idToken from the app to the back-end server, and intend to verify the token ...
Lucas Basquerotto's user avatar
1 vote
0 answers
1k views

Disabling weak cipher suites in Tomcat does not work as expected

I have to get rid of so called "weak security" in a Tomcat application. A penetration test identified services that accept connections with insecure TLS encryption and hashing algorithms: ...
MichaelW's user avatar
  • 161
1 vote
0 answers
667 views

Why is there no fix for the commons beanutils Java deserialization gadget?

I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library commons-beanutils. The ysoserial project references commons-beanutils ...
kaidentity's user avatar
  • 2,654
1 vote
0 answers
209 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
Sangamesh T's user avatar
1 vote
0 answers
307 views

How to extract Wireshark keylog from a Java JSSE TLSv1.3 Session

Is it possible to extract the Wireshark keylog information directly from the TLSv1.3 handshake in a Java app? If so, how do I map the fields, or is additional material not shared in the handshake ...
Yuri Schimke's user avatar
1 vote
0 answers
280 views

How to pentest a java application run through webswing?

I need to pentest a Java application through webswing. webswing allows running a java application in a web browser but how to pentest this? I didn't find any documentation about this actually. With my ...
salt's user avatar
  • 259
1 vote
0 answers
101 views

Android: what attack vectors are introduced by calling native code from the web (JS)?

I work on a large e-commerce project, the app in question is written in Kotlin (legacy code in Java). Recently we got the following question from the web team which instantly triggered my alarm bells: ...
Droidman's user avatar
  • 111
1 vote
0 answers
339 views

Wrapped Key Encryption - Hide AES secret key in Javascript & Java

I need to encrypt some sensitive fields back and forth in browser and server, same goes for decryption, for this I am planning to implement AES algorithm, but the problem here is with secret key which ...
Jian25's user avatar
  • 11
1 vote
0 answers
509 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
manish sardiwal's user avatar
1 vote
0 answers
136 views

Would my Java web application be vulnerable if I use a netty version that is vulnerable to CVE-2019-20444 and CVE-2019-20445?

These has been fixed in later versions of Netty ... but what is the risk of using an older (can't upgrade now) version that is vulnerable to to CVE-2019-20444 and CVE-2019-20445 ... is there really a ...
user7676946's user avatar
1 vote
1 answer
248 views

Concealing method results

I have to maintain a java application with security code I am not sure is really useful and the original purpose is not clear (and the original developer is long gone). Basically, the code will check ...
Stephen's user avatar
  • 111
1 vote
0 answers
1k views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested in ...
deletehead's user avatar
1 vote
0 answers
4k views

Implementation of Simple CSRF in Spring Boot and Angular 6 With Complete Solution

I am Implementing CSRF i.e Cross-Site Request Forgery in my project but not getting proper way to implement in my project and i am using Angular for FrontEnd and Java for BackEnd in Spring Boot and I ...
Kiran Mistry's user avatar
1 vote
0 answers
2k views

Bypass prepared statements?

I know that prepared statements are used to handle input at the front end. However I was wondering how do you bypass a prepared statement? I have seen some people talk about string concentration but I’...
user218030's user avatar
1 vote
1 answer
1k views

Java Applet AccessControlException

I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated. I have a Java applet fetching a malicious jar file and trying to then download ...
3therk1ll's user avatar
  • 147
1 vote
0 answers
137 views

Reduce form spam without external dependencies or false positives

I'm working on a Java Spring with a team and have been facing form spam issues. We are seeing a large number of requests that use generated & falsified information (ie everyone's names are generic,...
Chris's user avatar
  • 111
1 vote
0 answers
257 views

Is it possible to use the SunPKCS11 provider to talk to a TPM2.0 chip using TPM2-PK11 library?

I have a TPM 2.0 chip which contains an RSA signing key (AIK) and I would like to sign a message using Java and I was wondering whether it would be possible to use the SunPKCS11 provider to interface ...
westbeam87's user avatar
1 vote
0 answers
105 views

Is distributing software with KeyStores as resource secure?

I'm working on a client / server application. I want to encrypt the communication between the two. This GitHub project served as a starting point for me. It uses SSLEngine to establish a secure ...
rougemarsrover's user avatar
1 vote
1 answer
344 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
Nemesis's user avatar
  • 29
1 vote
0 answers
2k views

Can anyone provide a hint for Webgoat 8's Deserialization exercise?

Working on the Deserialization exercise in Webgoat (v. 8) The Burp extension "Java Deserialization Scanner" detects that this page is potentially vulnerable to the Hibernate 5 (sleep) payload. ...
mcgyver5's user avatar
  • 6,864
1 vote
0 answers
115 views

Are java bean oids predictable?

For example, I'm facing bean names such as "<3 CHAR PREFIX>" ex. "FIL000000AZB3Y" (random name) where FIL refers to a File object, and the 0000... is the OID. Is it possible to predict this, or is ...
Rob Gates's user avatar
  • 259
1 vote
0 answers
243 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
Jo_Nathan's user avatar
1 vote
0 answers
643 views

BadPaddingException when using the textbook cipher

I'm using an implementation as below to do an encryption where the bouncycastle is used as the crypto provider. So the ciphertext for a particular plaintext will not be dynamic as the RSA from ...
Prakhash's user avatar
  • 203
1 vote
0 answers
390 views

what is the logic in choosing a certificate chain during a "server-hello" message in a SSL/TLS handshake

In a client-server ssl handshake, my server sends a certificate chain back to the client in a server-hello message. But I want to understand as to how that particular certificate chain is getting ...
vistar81's user avatar
1 vote
0 answers
234 views

Choosing a more or less secure signature algorithm with very short signature length

For a software registration code, I would like to sign a phone number of around 14 digits with a private key and then check it in an app. I would imagine to use RSA or something but the signature ...
Alex's user avatar
  • 1,427
1 vote
0 answers
654 views

Bouncy Castle vs SunJCE for HMAC and RSA

I'm implementing the signing algorithms for JWS. For all the HMAC and RSA algorithms, the provider named "SunJCE" has them. But I am seeing almost all the popular JWT packages in Java has dependencies ...
neurite's user avatar
  • 171