Help Guide For Software Engineer: Security

Showing posts with label Security. Show all posts

Thursday, June 21, 2018

Protect PDF using password in iText

When you need to protect PDF files using password, you can use following iText codes to encrypt PDF using passwords.

String ownerPasswd="owner";
String userPasswd="user";

PdfReader reader = new PdfReader("/apps/abc.pdf");
PdfStamper stamper = new PdfStamper(reader, new FileOutputStream("/apps/abc_pw.pdf"));
stamper.setEncryption(userPasswd.getBytes(), ownerPasswd.getBytes(),
PdfWriter.ALLOW_PRINTING, PdfWriter.ENCRYPTION_AES_128 | PdfWriter.DO_NOT_ENCRYPT_METADATA);
stamper.close();
reader.close();

Library versions used,
itextpdf-5.5.10.jar
bcprov-ext-jdk14-1.47.jar

You can use preferred encryption algorithms. Refer documentations.

Wednesday, August 3, 2016

Call Username/Password enabled web service in JAVA

In this case, web service is secured with username and password authentication using WS-Security. Following code is used to generated SOAP message header to create security token to call web service.

RetailerAppWS appWS = new RetailerAppWS();
RetailerAppWSPortType retailerAppWSPortType = appWS.getRetailerAppWSHttpsSoap11Endpoint();
BindingProvider bindingProvider = (BindingProvider) retailerAppWSPortType;
@SuppressWarnings("rawtypes")
List handlerChain = new ArrayList();
handlerChain.add(new WSSecurityHeaderSOAPHandler("Retailer", "Retailer123"));
bindingProvider.getBinding().setHandlerChain(handlerChain);

PayBill payBill = new PayBill();
payBill.setAmount(1.0);
payBill.setPin("9834");
payBill.setReceiver("1234567890");
payBill.setUser("sujith");

PayBillResponse pbr = retailerAppWSPortType.payBill(payBill);

In the above code, it is created a WSSecurityHeaderSOAPHandler to manipulate the SOAP message to add security token to SOAP header.

WSSecurityHeaderSOAPHandler is shown below. This code will re-generate the SOAP message.

public class WSSecurityHeaderSOAPHandler implements SOAPHandler {

private static final String SOAP_ELEMENT_PASSWORD = "Password";
private static final String SOAP_ELEMENT_NONCE = "Nonce";
private static final String SOAP_ELEMENT_USERNAME = "Username";
private static final String SOAP_ELEMENT_Created = "Created";
private static final String SOAP_ELEMENT_Expires = "Expires";
private static final String SOAP_ELEMENT_USERNAME_TOKEN = "UsernameToken";
private static final String SOAP_ELEMENT_Timestamp_TOKEN = "Timestamp";
private static final String SOAP_ELEMENT_SECURITY = "Security";
private static final String NAMESPACE_SECURITY = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
private static final String PREFIX_SECURITY = "wsse";
private static final String NAMESPACE_WSU = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
private static final String PREFIX_WSU = "wsu";
private static final String NAMESPACE_TYPE = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText";
private static final String ATTRIBUTE_TYPE = "Type";
private static final String NAMESPACE_EncodingType = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary";
private static final String ATTRIBUTE_EncodingType = "EncodingType";
private static final String ATTRIBUTE_MustUnderstand ="mustUnderstand";

private String usernameText;
private String passwordText;

public WSSecurityHeaderSOAPHandler(String usernameText, String passwordText) {
this.usernameText = usernameText;
this.passwordText = passwordText;
}

public boolean handleMessage(SOAPMessageContext soapMessageContext) {

Boolean outboundProperty = (Boolean) soapMessageContext.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);

if (outboundProperty.booleanValue()) {

try {
SOAPEnvelope soapEnvelope = soapMessageContext.getMessage().getSOAPPart().getEnvelope();

SOAPHeader header = soapEnvelope.getHeader();
if (header == null) {
header = soapEnvelope.addHeader();
}

SOAPElement soapElementSecurityHeader = header.addChildElement(SOAP_ELEMENT_SECURITY, PREFIX_SECURITY,
NAMESPACE_SECURITY);
soapElementSecurityHeader.addAttribute(soapEnvelope.createName(ATTRIBUTE_MustUnderstand), "1");
soapElementSecurityHeader.addNamespaceDeclaration(PREFIX_WSU, NAMESPACE_WSU);

SOAPElement soapElementUsernameToken = soapElementSecurityHeader.addChildElement(SOAP_ELEMENT_USERNAME_TOKEN, PREFIX_SECURITY);
SOAPElement soapElementUsername = soapElementUsernameToken.addChildElement(SOAP_ELEMENT_USERNAME, PREFIX_SECURITY);
soapElementUsername.addTextNode(usernameText);

SOAPElement soapElementPassword = soapElementUsernameToken.addChildElement(SOAP_ELEMENT_PASSWORD, PREFIX_SECURITY);
soapElementPassword.addAttribute(soapEnvelope.createName(ATTRIBUTE_TYPE), NAMESPACE_TYPE);
soapElementPassword.addTextNode(passwordText);

SOAPElement soapElementUserCreated = soapElementUsernameToken.addChildElement(SOAP_ELEMENT_Created, PREFIX_WSU);
long created = System.currentTimeMillis();

TimeZone timeZone = TimeZone.getTimeZone("UTC");
Calendar calendar = Calendar.getInstance(timeZone);
SimpleDateFormat sdfu
= new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'", Locale.US);
sdfu.setTimeZone(timeZone);

String dateu = sdfu.format(calendar.getTime());
soapElementUserCreated.addTextNode(dateu);

SOAPElement soapElementNonce = soapElementUsernameToken.addChildElement(SOAP_ELEMENT_NONCE, PREFIX_SECURITY);
soapElementNonce.addAttribute(soapEnvelope.createName(ATTRIBUTE_EncodingType), NAMESPACE_EncodingType);
soapElementNonce.addTextNode(createNonce(created));

SOAPElement soapElementTimestampToken = soapElementSecurityHeader.addChildElement(SOAP_ELEMENT_Timestamp_TOKEN, PREFIX_WSU);
SOAPElement soapElementCreated = soapElementTimestampToken.addChildElement(SOAP_ELEMENT_Created, PREFIX_WSU);

soapElementCreated.addTextNode(dateu);

calendar.set(Calendar.MINUTE, calendar.get(Calendar.MINUTE) + 2);

SimpleDateFormat sdf2 = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
String date2 = sdf2.format(calendar.getTime());
SOAPElement soapElementExpires = soapElementTimestampToken.addChildElement(SOAP_ELEMENT_Expires, PREFIX_WSU);
soapElementExpires.addTextNode(date2);

} catch (Exception e) {
throw new RuntimeException("Error on wsSecurityHandler: " + e.getMessage());
}

}

return true;
}

@Override
public void close(MessageContext context) {
// TODO Auto-generated method stub
}

@Override
public boolean handleFault(SOAPMessageContext context) {
// TODO Auto-generated method stub
return true;
}

@Override
public Set getHeaders() {

final QName securityHeader = new QName(
NAMESPACE_SECURITY, SOAP_ELEMENT_SECURITY, PREFIX_SECURITY);

final HashSet headers = new HashSet();
headers.add(securityHeader);
return headers;
}

public String createNonce(long value) throws Exception {
java.security.SecureRandom random = java.security.SecureRandom.getInstance("SHA1PRNG");
random.setSeed(value);
byte[] nonceBytes = new byte[16];
random.nextBytes(nonceBytes);
String nonce = new String(org.apache.commons.codec.binary.Base64.encodeBase64(nonceBytes), "UTF-8");
return nonce;
}

}

NOTE :- Timestamp must be in UTC format. NONCE value must generated as above.

Call Username/Password enabled web service in JAVA

NOTE :- Timestamp must be in UTC format. NONCE value must generated as above.

Friday, July 15, 2016

OAuth2.0 client Token creation, Resource access, Refresh token

OAuth2.0 is used to authenticate and authorize resource access in web. Following code snip can be used to generate access tokens, access protected resources and refresh resources.

Libraries
httpcore-4.2.4.jar
httpclient-4.2.5.jar

1. Generate access tokens

String url = "authorization/token issuer URL";

DefaultHttpClient client = new DefaultHttpClient();
HttpPost post = new HttpPost(url);

// add header
post.setHeader("User-Agent", USER_AGENT);
post.setHeader("Content-Type", "application/x-www-form-urlencoded");
post.setHeader("Cache-Control", "no-cache");

List urlParameters = new ArrayList();
urlParameters.add(new BasicNameValuePair("username", "username1"));
urlParameters.add(new BasicNameValuePair("client_secret", "CQTYxzOUMCGGRt_MmKDKsWcFxrga"));
urlParameters.add(new BasicNameValuePair("grant_type", "password"));
urlParameters.add(new BasicNameValuePair("client_id", "OLBM3wf54GtT_R8HNbLztK63qHMa"));
urlParameters.add(new BasicNameValuePair("password", "password1"));

post.setEntity(new UrlEncodedFormEntity(urlParameters));

HttpResponse response = client.execute(post);
System.out.println("Response Code : "
+ response.getStatusLine());

BufferedReader rd = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));

StringBuffer result = new StringBuffer();
String line = "";
while ((line = rd.readLine()) != null) {
result.append(line);
}
System.out.println(result);

Above code will generate a "access_token" that can be used to access a protected resource in web.
Sample token is shown below.

{"token_type":"bearer","expires_in":2722,"refresh_token":"be3fe469bf5b62836e85ab73fa7c7935a","access_token":"6beb0a2a54d9wefad9401f6f8cecd1de"}

2. Access protected resource

above generated "access_token" is used here to access the resource.

String url = "protected resource URI";

DefaultHttpClient client = new DefaultHttpClient();
HttpPost post = new HttpPost(url);

// add header
post.setHeader("User-Agent", USER_AGENT);
post.setHeader("Content-Type", "application/json");
post.setHeader("Accept-Encoding", "UTF-8");
post.setHeader("Authorization", "Bearer access_token");
post.setHeader("Cache-Control", "no-cache");

StringEntity params = new StringEntity("{ \"sessionID\":\"123456789\", \"requestHeader\": { \"requestTime\":\"2016/06/25 08:00:00\", \"userName\": \"Sujith\", \"token\":\"abc123qpd452\" } }");
post.setEntity(params);

HttpResponse response = client.execute(post);
System.out.println("Response Code : "
+ response.getStatusLine());

BufferedReader rd = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));

StringBuffer result = new StringBuffer();
String line = "";
while ((line = rd.readLine()) != null) {
result.append(line);
}
System.out.println(result);

3. Refresh access token

Following code can be used to refresh the "access_token" generated above.

String url = "authorization/token issuer URL";

DefaultHttpClient client = new DefaultHttpClient();
HttpPost post = new HttpPost(url);

// add header
post.setHeader("User-Agent", USER_AGENT);
post.setHeader("Content-Type", "application/x-www-form-urlencoded");
post.setHeader("Cache-Control", "no-cache");

List urlParameters = new ArrayList();
urlParameters.add(new BasicNameValuePair("username", "username1"));
urlParameters.add(new BasicNameValuePair("client_secret", "CQTYxzOUMCGGRt_MmKDKsWcFxrga"));
urlParameters.add(new BasicNameValuePair("grant_type", "refresh_token"));
urlParameters.add(new BasicNameValuePair("client_id", "OLBM3wf54GtT_R8HNbLztK63qHMa"));
urlParameters.add(new BasicNameValuePair("password", "password1"));
urlParameters.add(new BasicNameValuePair("refresh_token","617ff4a46cb87eaaea113835d7c7e3"));

post.setEntity(new UrlEncodedFormEntity(urlParameters));

HttpResponse response = client.execute(post);
System.out.println("Response Code : "
+ response.getStatusLine());

BufferedReader rd = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));

StringBuffer result = new StringBuffer();
String line = "";
while ((line = rd.readLine()) != null) {
result.append(line);
}

System.out.println(result);

Tuesday, June 7, 2016

Trust certificates in JAVA

Following trust manager can be used to ignore validation certificate chains.

TrustManager[] trustAllCerts = new TrustManager[] {

new X509TrustManager() {

public java.security.cert.X509Certificate[] getAcceptedIssuers() {

return null;

}

public void checkClientTrusted(

java.security.cert.X509Certificate[] certs, String authType) {

}

public void checkServerTrusted(

java.security.cert.X509Certificate[] certs, String authType) {

}

};

// Install the all-trusting trust manager

try {

SSLContext sc = SSLContext.getInstance("SSL");

sc.init(null, trustAllCerts, new java.security.SecureRandom());

HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

} catch (GeneralSecurityException e) {

}

Monday, May 9, 2016

Access VM server in host error

In cases, where we want to connect to VM running servers from HOST OS, we need to disable the iptable firewall permission in Linux.

Use following command to disable firewall in Linux. In root access, execute the command.

IPV4 firewall

/etc/init.d/iptables stop

IPV6 firewall

/etc/init.d/ip6tables stop

NOTE :- In VM player set network adapter to host-only mode to create private network with host and VM OS.

Monday, October 27, 2014

Password Authenticate with SALT value

In password authentication, most developers use hash value generation. Hash value has a unique value for every word. If two users have same password, both has same hash value for their password. The solution is to generate salt value for password. Before proceeding hash generating, password is appended with salt value. The salt value is not a secret value. For validation, hash value and salt value must be known from the developer.

Following article for user authentication described clearly with sources..

https://crackstation.net/hashing-security.htm#normalhashing

Thursday, January 17, 2013

Store certificate in key store

When it is using trusted certificate in JAVA, it needs to be stored in JAVA key store.

JAVA default key store is %JAVA_HOME/jre/lib/security/cacerts

Using following command you can create a specific key store.

keytool -keystore keystore_name -storepass changeit -file \export\home\root.cer -import -alias alias_name -trustcacerts

Then use the following JAVA code to use the created key store.

System.setProperty("javax.net.ssl.trustStore", "./keystore_name ");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.ssl.trustStoreType", "JKS");

Monday, April 2, 2012

Create HTTPS Web Service Client

HTTPS web services uses certificate authentication. So, web service clients must be created with SSL.

In netbeans, you can create HTTPS web service client. Follow the steps.

1) Create Java project in Netbeans
2) Copy certificate into project root directory
3) Use Netbeans Web Service Client wizard to create client

This will create web service clients successfully. But, when calling service, it is again needed to create SSL session with service.

Before calling service, certificate needs to be stored in java key store.

Refer article on seguide :- http://seguide.blogspot.com/2009/12/use-keytool-to-generate-keys-in-java.html

Use following code before calling service methods.

System.setProperty("javax.net.ssl.trustStore", "export/home/myTrustStore"); System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.ssl.trustStoreType", "JKS"); System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol"); Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());

URL url = new URL("https://~~~~~~~~~~~~~~~~~~~/service.asmx?wsdl");
Service service = new Service(url); service.getServiceSoap().getData();

Wednesday, July 20, 2011

RSA java encrypt, decrypt

Following code can be used to encrypt, decrypt string using RSA encryption.

NOTE :- Apache Commons Codec used for encode string to base64.

import java.math.BigInteger;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.spec.RSAPrivateKeySpec;
import java.security.spec.RSAPublicKeySpec;

import javax.crypto.Cipher;
import org.apache.commons.codec.binary.Base64;

public class MainClass {

public static void main(String[] args) throws Exception {
byte[] expBytes = Base64.decodeBase64("AQAB");
byte[] modBytes = Base64.decodeBase64("nzLiZDSiu484r5NcBQN3rNP3x5aqY3Eq6CkQDwuilTzd5ZNdTcTxw7C1JQ9ih27Vq4RU9NYgi9oOUTVQ2gkqP1OJA9aawjCRwMJ7PRyKlBEpsdE/wFtu9/1ciGRtWSyACr2jTASZPQa+aHQh2qziacWd+iVmGIq0+l11nGG/GYU=");
byte[] dBytes = Base64.decodeBase64("nyF45NssUzkdW3t7/tLxfENBKTN0TARh9ECfebqSoIR/9awxFrynQYnP+CSBw4jJcjHLzhR/4etsZkZZ9Cg3HhPA5pjVcI5kJct4kLjWM+ejZliZoV/KvpJN261VKKLTJMX64UeMiLAlb7mUNoNqKztgflxz5Dbad5hemvgwg50=");

BigInteger modules = new BigInteger(1, modBytes);
BigInteger exponent = new BigInteger(1, expBytes);
BigInteger d = new BigInteger(1, dBytes);

KeyFactory factory = KeyFactory.getInstance("RSA");
Cipher cipher = Cipher.getInstance("RSA");
String input = "test";

RSAPublicKeySpec pubSpec = new RSAPublicKeySpec(modules, exponent);
PublicKey pubKey = factory.generatePublic(pubSpec);
cipher.init(Cipher.ENCRYPT_MODE, pubKey);
byte[] encrypted = cipher.doFinal(input.getBytes("UTF-8"));
System.out.println(encrypted);
System.out.println("encrypted: " + new String(encrypted));

RSAPrivateKeySpec privSpec = new RSAPrivateKeySpec(modules, d);
PrivateKey privKey = factory.generatePrivate(privSpec);
cipher.init(Cipher.DECRYPT_MODE, privKey);
byte[] decrypted = cipher.doFinal(encrypted);
System.out.println("decrypted: " + new String(decrypted));
}
}

Sunday, May 2, 2010

Type Cast in Java Script

In js, variables are created as var type. That means, js engine can cast it to the original type by itself.

parseInt(12) will be converted 12 to an Integer value.

           Example                   Result
parseInt("12")                          12
parseInt("12.657")                    12
parseInt("12aaaa")                   12
parseInt("aaaa")                NaN (means "Not a Number")

Friday, April 23, 2010

Encrypt, Decrypt password in Mysql

Inserting password encrypted to database using the following sql.

INSERT INTO PASSWORD(pass) VALUES(DES_ENCRYPT('user password')); 

This SQL will encrypt the user inserted password to a encrypted text. In table level, password is unreadable.

Instead of DES_ENCRYPT() method you can come up with your own function.

Selecting password from database to a string.

SELECT DES_DECRYPT(pass) FROM PASSWORD ;

This SQL will return user password as user inserted.

Wednesday, December 2, 2009

Use keytool to generate keys in java

keytool -genkey -alias weblogic -keyalg RSA -keystore server.keystore
keytool -selfcert -export -alias weblogic -storepass changeit -file server.cer -keystore server.keystore
keytool -genkey -alias client -keyalg RSA -keystore client.keystore
keytool -selfcert -export -alias client -storepass changeit -file client.cer -keystore client.keystore
keytool -import -v -trustcacerts -alias weblogic -file server.cer -keystore client.keystore -keypass changeit -storepass changeit
keytool -keystore \jre\lib\security\cacerts -storepass changeit -file client.cer -import -alias client -trustcacerts

Here, i have created server.cer and client.cer certificates. Password used is "changeit".