Collaborate Disseminate
Can anybody explain the code flow of tomcat’s Authentication and Authorization.
Or how we can explore, is there any way ?
I have seen the code from BasicAuthenticator.java,AuthenticatorBase.java etc.
But want to understand… Continue reading Tomcat : Authentication and Authorization Flow
I was wondering whether TLS_ECDHE_RSA_WITH_RC4_128_SHA is secure.
We have added it within the ciphers tag of the Tomcat configuration file.
Can we make WEB-INF folder in tomcat readonly ?
This is to make tomcat configuration files secure from web shells,Path traversal vulnerabilities.
Thanks in advance.
Continue reading Is it possible to make WEB-INF folder readOnly in tomcat? [on hold]
Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)
(Output from TLS1.0 disabled)
$ openssl s_client -conne… Continue reading Using the openssl command, how can I tell if it’s using TLS 1.0?
I have received some weird request URL in my TOMCAT access logs. which is as follows:-
\x16\x03\x01\x01\”\x01″ 200 40788
as clearly seen from above log, the server has given 200(success) response to the client(the one who … Continue reading Received weird request URL in my TOMCAT access logs
I need to make sure that a web app running on Tomcat 6.0.36 with Java 1.8 is only using TLS 1.2
As per documentation, I tried adjusting the Connector section in server.xml:
sslProtocol=”TLSv1.2″ (I even set sslEnabledProtocols, even thou… Continue reading Only Enable TLSv1.2 on Tomcat 6.0.36
We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data at rest. For our use-cas… Continue reading Encrypting File System Data at Rest on Windows Web Application
I setup a test Ubuntu VPS about a month ago to run DHIS2, running on top of PostgreSQL and Tomcat (https://docs.dhis2.org/master/en/implementer/html/installation.html). No other software was installed. A few days ago I got an… Continue reading Ubuntu server rooted – apparently running dllhost? (Mystery solved) [on hold]
I have the following url “/doSomeAction.do” which is mapped to some internal jsp say “/jsp/printNames.jsp”
The following url’s
/doSomeAction.do and
/;/doSomeAction.do does the same operation how?
How struts considers b… Continue reading How ";" path parameter is validated by tomcat and how struts allows me to enter the class file? [migrated]
I have the application in Spring Boot with embedded Tomcat. I’ll want use owasp mod security. How can I redirect network traffic that mod security will see it? I develop my app on localhost and I only show how Mod Security wo… Continue reading Mod Security OWASP with Spring Boot [migrated]