21
votes
Accepted
Using the openssl command, how can I tell if it's using TLS 1.0?
TL;TR: It is far from trivial to verify from the client that a server is not supporting TLS 1.0. You can be sure that the server supports TLS 1.0 if you get a successful connection with TLS 1.0. But ...
- 208k
7
votes
Using the openssl command, how can I tell if it's using TLS 1.0?
Although these tools do not directly answer your specific question, they may provide the results you are looking for.
If you have an Internet connection, try some of these:
https://www.htbridge.com/...
- 251
4
votes
Accepted
Received weird request URL in my TOMCAT access logs
\x16\x03\x01...
This is the start of a TLS 1.0 ClientHello, i.e. the begin of a TLS handshake. The \x16 is the TLS record type 22 (hex 16 is decimal 22) which means handshake. The next two bytes are ...
- 208k
4
votes
Does Apache Tomcat 9 meet PCI compliance?
Individual software packages are not judged compliant or non-compliant by PCI. Rather, the organization using them is required to attest that they are following PCI-approved practices where they ...
- 73.3k
4
votes
Is this parameter vulnerable to SQL Injection?
No, the error does not indicate SQL injection.
String or binary data would be truncated.
This means that the data you try to insert is too big for the column. If the column is of type CHAR(10), ...
- 34.4k
3
votes
Accepted
What measures can be taken to prevent Server Side Request Forgery (SSRF) in a JAX-RS Application running on Apache Tomcat?
Neither Tomcat nor JAX-RS documentation mentions anything to prevent SSRF attacks. So I would assume there is no protection by default.
SSRF typically abuses the trust placed in a server by other ...
- 492
3
votes
Accepted
Is Tomcat protecting against CSRF correctly?
You are correct, but this requires a specific and rather unusual behavior of the protected web application to work.
You are referring to the chapter "CSRF token is simply duplicated in a cookie" from ...
- 7,545
3
votes
Accepted
Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat
The vulnerability is present in the binary interface that the AJP server provides, and will only be available to Apache HTTPd. Unless the AJP port is exposed to a public network, one cannot exploit it ...
- 158
3
votes
Accepted
Does the CA have to be same for mutual authentication?
Client and server authentication don't have to use the same CAs, but you should tell the server which CAs it should trust to authenticate clients, which seems to be the issue here.
Why? Many people ...
- 256
3
votes
Using the openssl command, how can I tell if it's using TLS 1.0?
This output means we have successfully disabled TLS 1.0:
CONNECTED(00000003)
140089425225616:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:s3_pkt.c:1493:SSL alert number 70
...
- 31
3
votes
Using the openssl command, how can I tell if it's using TLS 1.0?
Yes that website is wrong; CONNECTED means the TCP connection succeeded but says nothing about the TLS (or hopefully not SSL) handshake. If you don't get CONNECTED but get a few lines ending with ...
- 11.1k
3
votes
Accepted
Is TLS_ECDHE_RSA_WITH_RC4_128_SHA secure?
RC4 in TLS is subject to bias problems. In a pragmatic sense, while this has been exploited in lab conditions, it isn't very likely that you'll fall victim to it in practice. However, the cost of ...
- 136k
2
votes
Accepted
Access encrypted files (dm-crypt/LUKS) through web app
> Will a java app be able to seamlessly access those files?
Yes, and you don't need sudo for that (NEVER RUN A WEBSERVICE AS ROOT). Once the luks partition is opened and mounted, application ...
- 9,293
2
votes
Why is CVE-2017-12617 considered a vulnerability?
From the CVE
This JSP could then be requested and any code it contained would be executed by the server.
PUT suggests a resource will be placed. But unless the API explicitly states so it does ...
- 11k
2
votes
Host header injection attack with Spring boot embedded tomcat
This is an Old question. But adding an answer as Spring has added support for whitelisting in Spring security 4.2.17 and 5.2. This might be useful for others.
In the security config:
@Override
...
- 121
2
votes
Tomcat application arbitrary file read exploitation
The fact that you're already able to read from web.xml in the /WEB-INF/ directory should be more than enough to give you an idea of which other files you can read. The purpose of web.xml is to have ...
- 51
2
votes
Using certificate on same server but different port for https
I figured out the issue. The problem was not with the CA key, it was with the private key. Once i remade the private key using this:
keytool -genkey -alias gis.akrf.com -keyalg RSA -keystore "C:\...
- 21
2
votes
can a tomcat application sitting behind a reverse proxy be exploited
This specific vulnerability works by exploiting invalid payload length in Websocket frames. Websocket frames are exchanged after the initial Websocket upgrade.
A simple reverse proxy will simply pass ...
- 208k
1
vote
spring4shell correction in tomcat
The guidelines from the Spring framework state that upgrading tomcat provides "adequate" protection, however it is recommended to further harden by altering disallowed fields parameters. I ...
- 1,346
1
vote
Security headers in application vs. Tomcat default 40x error
What's on the error page? For Apache Tomcat, it typically contains the requested URL, type of the error message, a human readable description of the error and Tomcat version information.
The error ...
- 19.4k
1
vote
Accepted
What is the security risks of increasing the maximum number of HTTP parameter?
As someone said in a comment, this reeks of bad design.
Anyway, in the past there have been denial of service attacks against server software done by using many parameters that share the same hash as ...
- 6,284
1
vote
Accepted
Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally
Focusing solely on the (claimed) security benefits. There are multiple elements to this. I'll address each in turn.
Robustness against attacks that utilise malformed requests. The thinking here is ...
- 125
1
vote
Exfiltration through FTP using XXE on a Tomcat server
I'm not sure what exactly is going on, but it looks like the client (your target) is sending the file's contents to the server as if it contains FTP commands. What if you just listen with netcat? ...
- 33.1k
1
vote
System Infected: Trojan.Naid Activity
From here:
Trojan.Naid is a Trojan horse that opens a back door on the compromised computer.
When the Trojan is executed, it creates the following files:
%UserProfile%\AppMgmt.dll %Windir%...
- 692
1
vote
Host header injection attack with Spring boot embedded tomcat
For non-standalone Tomcat, the trick is to configure two virtual servers, where one is the default and belongs to no web application and the other one is the real one where your web application is ...
- 11
1
vote
Using the openssl command, how can I tell if it's using TLS 1.0?
Instead of openssl, you can use curl with --tls-max parameter, e.g.
curl -vI --tls-max 1.0 https://example.org/
curl -vI --tls-max 1.1 https://example.org/
curl -vI --tls-max 1.2 https://example.org/
...
- 839
1
vote
Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
My guess is that you referring to CVE-2004-0492 "mod_proxy in Apache 1.3.25 to 1.3.31 ... possibly execute arbitrary code via a negative Content-Length HTTP header field..." . As you can see, this bug ...
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible