Explaining Java Deserialization Vulnerabilities (Part 2)
In this part, we continue with even more harmful attacks and show you how you can prevent this in your own code.
Security
A Compendium of 2021 Java & OpenJDK Predictions
Now that 2021 is well underway, many prominent Java developers have taken the time to predict what 2021 may bring to the Java universe!
Explaining Java Deserialization Vulnerabilities (Part 1)
Java serialization—and specifically deserialization—is “the gift that keeps on giving” for the security issues produced over the years.
Hacking Java XML Input via External Entity Injection
In this video, I explain and demonstrate how an XXE injection attack works by extracting system data that should not be exposed.
Let's Do Some Java Syntax Puzzlers Today
Given I love a good puzzle (especially the Java Puzzles), let’s try some puzzles, using the Java syntax only, without any runtime behavior.
5 Tips to Create Secure Docker Images for Java Applications
Naively creating custom Docker images for Java apps comes with security concerns. How do we make security an essential part of Docker …
Minimizing Security Risks in Application Development
United by their passion for open source, Payara and IBM recently teamed up for a panel discussion on security in Java application …
Use Query Parameterization to Prevent Injection
Tip: By distinguishing between the SQL code and the parameter data, the query can’t be hijacked by malicious input.
Avoid Java Serialization: The Gift That Keeps On Giving
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.
How to Configure Your Java XML Parsers to Prevent XXE Attacks
With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, and read the content of an arbitrary file on the machine.