Hacking Java XML Input via External Entity Injection
In this video, I explain and demonstrate how an XXE injection attack works by extracting system data that should not be exposed.
Security
Let's Do Some Java Syntax Puzzlers Today
Given I love a good puzzle (especially the Java Puzzles), let’s try some puzzles, using the Java syntax only, without any runtime behavior.
5 Tips to Create Secure Docker Images for Java Applications
Naively creating custom Docker images for Java apps comes with security concerns. How do we make security an essential part of Docker …
Minimizing Security Risks in Application Development
United by their passion for open source, Payara and IBM recently teamed up for a panel discussion on security in Java application …
Use Query Parameterization to Prevent Injection
Tip: By distinguishing between the SQL code and the parameter data, the query can’t be hijacked by malicious input.
Avoid Java Serialization: The Gift That Keeps On Giving
If you need to Deserialize an inputstream yourself, you should use an ObjectsInputStream with restrictions.
How to Configure Your Java XML Parsers to Prevent XXE Attacks
With XML eXternal Entity (XXE) enabled, it is possible to create a malicious XML, and read the content of an arbitrary file on the machine.
Securing Microservices with Auth0 and MicroProfile in Kubernetes
This presentation by Ondrej Mihalyi at DevOpsCon showcases the strength of combining MicroProfile and an OAuth service.
Fixing Vulnerabilities in Maven-Based Projects
In this article, I will explain how you can fix vulnerabilities in third-party libraries when using Maven, even when it is not obvious.
foojay: A Place for Friends Of OpenJDK
For Java developers who depend on OpenJDK, foojay is the place to be for comprehensive dashboards, insights, analysis, and blogs. Read More!