Collaborate Disseminate
Conventional wisdom seems to dictate that java applications should always be reverse proxied. It’s what I have always done and so has everywhere I have worked at.
I have read multiple times that reverse proxying is recommend… Continue reading Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally
I tried a few things, but it appears that it’s not vulnerable, however I can achieve XSS via the error message the application throws.
Error:
Failed to convert property value of type java.lang.String to required type boolea… Continue reading SQL injection via parameter, vulnerable or not?
Aleksei Tiurin is the Senior Security Researcher for Acunetix. He is performing a technical segment on reverse proxies using weblogic, Tomcat, and Nginx. To learn more about Acunetix, go to: www.acunetix.com/securityweekly Full Show Notes Follow us on … Continue reading Aleksei Tiurin, Acunetix – Application Security Weekly #42
I’m trying to establish mutual authentication between my Tomcat server and my customer’s firewall.
The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate).
The certificate chain in the Server… Continue reading Does the CA have to be same for mutual authentication?
In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.
In classic scenario, I tried to read /etc/passw… Continue reading Tomcat application arbitrary file read exploitation
I’m trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I’m hosting two DTD’s on Github Gist. These are their contents:
Base XML (What gets sent to the server):
<?xml … Continue reading Exfiltration through FTP using XXE on a Tomcat server
Septemeber was full of Azure announcements from Ignite, Aidan breaks all the news down so that it is easier to digest.
The post Everything You Need to Know About Azure Infrastructure – September 2018 Edition appeared first on Petri.
Continue reading Everything You Need to Know About Azure Infrastructure – September 2018 Edition
The backend server is running Tomcat 8.5 (Java backend). The URL in question is:
https://website.com/application/servlet.do?currentOID=abc12300000000
I found that when I give an incomplete OID (i.e 1 char remove), or I add… Continue reading Is this parameter vulnerable to SQL Injection?
For example, I’m facing bean names such as “<3 CHAR PREFIX>” ex. “FIL000000AZB3Y” (random name) where FIL refers to a File object, and the 0000… is the OID. Is it possible to predict this, or is prediction only possible … Continue reading Are java bean oids predictable?
Edgy XSS bypass, hacking fitness tracking in China, Russian hackers love power, leaky backups, Google hates Phishing for Google employees, Apache Tomcat, Solaris vulnerabilities that weren’t really fixed, OpenWhisk fails to beat a vulnerability. … Continue reading Russian Hackers, OpenWhisk, and Tomcat – Hack Naked News #182