page and pageContext in JSP

as we know the page and pageContext is the two important objects in real JSP implementation.

please go through the following Example and i need your Comments so that i can gain some thing....

sample.jsp


<b>Page context Details<br>
Page context Adddress  :<%=pageContext%><br>
Page context Adddress.toString()  :<%=pageContext.toString()%><br>
Page Context hashCode  :<%=pageContext.hashCode()%><br>
Current Object Address  :<%=this%><br>


<b>Page Details <br>

Page Address  :<%=page%><br>
Page Address. toString()  :<%=page.toString()%><br>

Page hashCode  :<%=page.hashCode()%><br>




the Out put is......




1.Page context Details
2.Page context Adddress 3.:org.apache.jasper.runtime.PageContextImpl@5ebc6e
4. Page context Adddress.toString() 5.:org.apache.jasper.runtime.PageContextImpl@5ebc6e
6.Page Context hashCode :6208622
7.Current Object Address 8.:org.apache.jsp.AdminSaaS.sample_jsp@a7f8a4
 

9.Page Details
10.Page Address :org.apache.jsp.AdminSaaS.sample_jsp@a7f8a4
11.Page Address. toString() 12.:org.apache.jsp.AdminSaaS.sample_jsp@a7f8a4
13.Page hashCode :11008164


please notify that 8 th and 10 th line out put is same.....

Disabling the Scriplets in JSP

You might be knowing that writing the scriplet tags in JSP is a Crime according to MVC(Model View Controller ) Design Pattern

you can restrict that configuring some tags in JSP as follows.



You can disable scriptlets within a page using the web.xml deployment descriptor by choosing to disable evaluation for a single page, a set of pages, or for the entire application. The tags that you need to add to the deployment descriptor are within the <jsp-config> element. The following example disables scriptlets for all JSP pages within an application:

<jsp-config>
<jsp-property-group>
<url-pattern>*.jsp</url-pattern>
<scripting-invalid>true</scripting-invalid>
</jsp-property-group>
</jsp-config>

The <url-pattern> element can represent a single page, for example:

<jsp-config>
<jsp-property-group>
<url-pattern>/test.jsp</url-pattern>
<scripting-invalid>true</scripting-invalid>
</jsp-property-group>
</jsp-config>

It can also represent a set of pages, for example:

<jsp-config>
<jsp-property-group>
<url-pattern>/noscriptlets/</url-pattern>
<scripting-invalid>true</scripting-invalid>
</jsp-property-group>
</jsp-config>


Thanks..

Brute Force Attack--The Dawn of Decryption

Can you belive that the data in this universe is not secure because of this Methodogy---THE BRUTE FORCE DECRYPTION
(it may take fraction of a second or some thousands of years to decrypt the Data and it's very costly to implement.) 

In cryptography, a brute force attack or exhaustive key search is a strategy that can in theory be used against any encrypted data by an attacker who is unable to take advantage of any weakness in an encryption system that would otherwise make his task easier. It involves systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire search space.
The key length used in the encryption determines the practical feasibility of performing a brute force attack, with longer keys exponentially more difficult to crack than shorter ones. Brute force attacks can be made less effective by obfuscating the data to be encoded, something that makes it more difficult for an attacker to recognise when he has cracked the code. One of the measures of the strength of an encryption system is how long it would theoretically take an attacker to mount a successful brute force attack against it.
Brute-force attacks are an application of brute-force search, the general problem-solving technique of enumerating all candidates and checking each one.

The EFF's US$250,000 DES cracking machine contained over 1,800 custom chips and could brute force a DES key in a matter of days. The photograph shows a DES Cracker circuit board fitted with several Deep Crack chips.

The only proven unbreakable encryption method

One Time Key encryption - the only proven
unbreakable encryption method

Characteristics of the One Time Key encryption method

The One Time Key encryption method is a binary additive stream cipher, where a  stream of truly random keys is generated and then combined with plain text for encryp -tion or with ciphertext for decryption by an ‘exclusive OR’ (XOR) addition.It is possible to prove a stream cipher encryption algorithm is unbreakable if the following preconditions are met:

•                             The key must be as long as the plain text

                        

•                             The key must be truly random

                        

•                             The key must only be used once

for more information please click below.


click here

Blow Fish Algorithm ?

Blowfish is a block cipher that encrypts data in 8-byte blocks. The algorithm consists of two parts: a key-expansion part and a data-encryption part. Key expansion converts a variable-length key of at most 56 bytes (448 bits) into several subkey arrays totaling 4168 bytes. (Note: the description in this article differs slightly from the one in the April 1994 issue of Dr. Dobb's Journal; there were typos in steps (5) and (6) of the subkey generation algorithm.)
Blowfish has 16 rounds. Each round consists of a key-dependent permutation, and a key- and data-dependent substitution. All operations are XORs and additions on 32-bit words. The only additional operations are four indexed array data lookups per round.
Subkeys:
Blowfish uses a large number of subkeys. These keys must be precomputed before any data encryption or decryption. The P-array consists of 18 32-bit subkeys: P1, P2,..., P18. There are also four 32-bit S-boxes with 256 entries each: S1,0, S1,1,..., S1,255; S2,0, S2,1,..,, S2,255; S3,0, S3,1,..., S3,255; S4,0, S4,1,..,, S4,255.
Encryption and Decryption:
Blowfish has 16 rounds. The input is a 64-bit data element, x. Divide x into two 32-bit halves: xL, xR. Then, for i = 1 to 16:
xL = xL XOR Pi
xR = F(xL) XOR xR
Swap xL and xR
After the sixteenth round, swap xL and xR again to undo the last swap. Then, xR = xR XOR P17 and xL = xL XOR P18. Finally, recombine xL and xR to get the ciphertext.
Function F looks like this: Divide xL into four eight-bit quarters: a, b, c, and d. Then, F(xL) = ((S1,a + S2,b mod 2³²) XOR S3,c) + S4,d mod 232.
Decryption is exactly the same as encryption, except that P1, P2,..., P18 are used in the reverse order.
Generating the Subkeys:
The subkeys are calculated using the Blowfish algorithm:
1. Initialize first the P-array and then the four S-boxes, in order, with a fixed string. This string consists of the hexadecimal digits of pi (less the initial 3): P1 = 0x243f6a88, P2 = 0x85a308d3, P3 = 0x13198a2e, P4 = 0x03707344, etc.
2. XOR P1 with the first 32 bits of the key, XOR P2 with the second 32-bits of the key, and so on for all bits of the key (possibly up to P14). Repeatedly cycle through the key bits until the entire P-array has been XORed with key bits. (For every short key, there is at least one equivalent longer key; for example, if A is a 64-bit key, then AA, AAA, etc., are equivalent keys.)
3. Encrypt the all-zero string with the Blowfish algorithm, using the subkeys described in steps (1) and (2).
4. Replace P1 and P2 with the output of step (3).
5. Encrypt the output of step (3) using the Blowfish algorithm with the modified subkeys.
6. Replace P3 and P4 with the output of step (5).
7. Continue the process, replacing all entries of the P array, and then all four S-boxes in order, with the output of the continuously changing Blowfish algorithm.
In total, 521 iterations are required to generate all required subkeys. Applications can store the subkeys rather than execute this derivation process multiple times.

C Code:

C code for Blowfish starts on page xx. This is improved and corrected code; the code in the April 1994 issue had some bugs and was less efficient than this code. The code is also available electronically; see "Availability," page xx.

Cryptanalysis of Blowfish

When first presented Blowfish last year, Dr. Dobb's Journal sponsored a cryptanalysis contest. There were five submissions in total, and I am pleased to present the most interesting results here.
John Kelsey developed an attack that could break 3-round Blowfish, but was unable to extend it. This attack exploits the F function and the fact that addition mod 232 and XOR do not commute. Vikramjit Singh Chhabra looked at ways of efficiently implementing a brute-force keysearch machine.
Serge Vaudenay examined a simplified variant of Blowfish, with the S-boxes known and not key-dependent. For this variant, a differential attack can recover the P-array with 28r+1 chosen plaintexts (r is the number of rounds). This attack is impossible for 8-round Blowfish and higher, since more plaintext is required than can possibly be generated with a 64-bit block cipher.
For certain weak keys that generate weak S-boxes (the odds of getting them randomly are 1 in 2¹⁴), the same attack requires only 24r+1 chosen plaintexts to recover the P-array (again, assuming the S-boxes are known). With unknown S-boxes, this attack can detect whether a weak key is being used, but cannot determine what it is (neither the S-boxes, the P-array, nor the key itself). This attack only works against reduced-round variants; it is completely ineffective against 16-round Blowfish.
Even so, the discovery of weak keys in Blowfish is significant. A weak key is one for which two entries for a given S-box are identical. There is no way to check for weak keys before doing the key expansion. If you are worried, you have to do the key expansion and check for identical S-box entries after you generate a Blowfish key. I don't think it's necessary, though.

Conclusion

No one has come close to developing an attack that breaks Blowfish. Even so, more cryptanalysis is required before pronouncing the algorithm secure. I invite others to continue analyzing the algorithm.

Size of the ResultSet ??

Do you know that there is no method defined to know the size of the ResultSet,
but there are other ways to achieve this.

the way is.....

• Make your ResultSet Scrollable ( purely optional step you can use ResultSet also)
• call rs.last()
• call the getRow()  which will give you the current row number, ultimately it will give you the number of rows because we called the last method on ScrollableResultSet.
• and finally call rs.beforeFirst() method to re point the pointer to the original position. 

Thanks
Yuvaraj Rajesh Kumar

Relation between toString() and hashCode() methods...

If you are a java programmer you need to have the clear picture of the java.lang.Object class, this Object class has the most important methods like toString() and hashCode() method. now you will be scratching your head what is the relation between toString() and hashCode() methods.
the Answer is as follows.

• The Signature of the hashCode method is as follows.

                public native int hashCode();

 the hashCode method is a native method  which returns the integer value.

• The Signature of the toString() method is as follows.

     public String toString() 
      { 
return getClass().getName() + "@" +Integer.toHexString(hashCode());
       }


 so the toString() methods internally uses hashCode() Method.

Actually
                                 System.out.println(reference);

                                            is equivalent to

                                 System.out.println(reference.toString());

the example for the above concepts is as follows..

Example-1

//MyDemo.java

public class MyDemo
{
public String toString()
{
return "secret";
}
public static void main(String ar[])
{
MyDemo m=new MyDemo();
System.out.println(m);
System.out.println(m.toString());
}
}

Output is...

secret

secret

***************************************************************

Example-2

//MyDemo.java

public class MyDemo
{
public int hashCode()
{
return 1;
}

public String toString()
{
return "secret";
}
public static void main(String ar[])
{
MyDemo m=new MyDemo();
System.out.println(m);

}

}

Output is..

secret

because the toString() method internally uses hashCode() method only in Object class.

right now we are not calling the hashCode() function.

that is why we will get only secret as a output

 

Can we Override the Native Methods in The Java ..???

native method is a great way to gain and merge the power of C or C++ programming into Java. To use Java as a scientific and high performance language, when efficient native Java compilers are not fully implemented, use native method can boost the performance to at least the speed of C compiled code.
 Example for this concept is as follows.

public class MyDemo
{
public Object clone()
{
return "hai";
}
}

Can we Create Immuteble Classes in java..

Most of the times the Immutable objects are very handy.
The advantages of the Immutable Objects are as follows

• The content of the Immutable Objects are Immutable which are most widely used in Caching o fan Objects bcoz all the objects will have the same content
• The Immutable objects are inherently Thread Safe so the Programmer need not to worry about multi- threading concept.
• Ultimately the content of the Immutable Objects never Changes.even though the programmer created the 'n'  number of objects  all the objects will have the same content, whose value cannot be changed.

The Example of the Above said criteria can be explained in the following Java Example.

To achieve the Immutable Objects follow the below instructions.

1. Declare the class as final so it can’t be extended.
2. Make all fields private so that direct access is not allowed.
3. Don’t provide setter methods for variables
4. Make all mutable fields final so that it’s value can be assigned only once.
5. Initialize all the fields via a constructor performing deep copy.
6. Perform cloning of objects in the getter methods to return a copy rather than returning the actual object reference.

 //Immute.java

public final class Immute {

    private final int id;

    private final String name;

     /**
     * Accessor function for mutable objects
     */
    /**
     * Constructor performing Deep Copy
     * @param i
     * @param n
    */

    public Immute(int i, String n){
        System.out.println("Performing Deep Copy for Object initialization");
        this.id=i;
        this.name=n;
      
    }

    /**
     * Constructor performing Swallow Copy
     * @param i
     * @param n
     * @param hm
     */
    /**
    public Immute(int i, String n, HashMap<String,String> hm){
        System.out.println("Performing Swallow Copy for Object initialization");
        this.id=i;
        this.name=n;
        this.testMap=hm;
    }
    */

    /**
     * To test the consequences of Swallow Copy and how to avoid it with Deep Copy for creating immutable classes
     * @param args
     */
    public static void main(String[] args) {
       
        String s = "original";

        int i=10;

       Immute ce = new Immute(i,s);

        //Lets see whether its copy by field or reference
    
        //print the ce values
        System.out.println("ce id:"+ce.id);
        System.out.println("ce name:"+ce.name);
   
        //change the local variable values
        i=20;
        s="modified";
     
        //print the values again
        System.out.println("ce id after local variable change:"+ce.id);
        System.out.println("ce name after local variable change:"+ce.name);
}

}
Output is.....

ce id:10
ce name:original
ce id after local variable change:10
ce name after local variable change:original

IS IT POSSIBLE TO DECRYPT SHA1 Algorithm !!!!!!

It is Highly impossible to Decrypt the SHA1 (in java) password because.......

• when ever the user get registered in to a any web service the password of the user will be encrypted using the Hash function.
• From the next time onwards when ever the user gets registered the entered password will be encrypted again and compared with the string which is present inside the database.
• if the user is valid user then only he/she will be given the access to the web resource.

Thanks

Yuvaraj Rajesh Kumar

SHA1 Algorithm(Using Java)

SHA is a cryptographic message digest algorithm similar to MD5. SHA-1 hash considered to be one of the most secure hashing functions, producing a 160-bit digest (40 hex numbers) from any data with a maximum size of 2⁶⁴ bits. While Java has built in classes to compute SHA 1 hash, it's quite uneasy to use them for a simple task -- calculate SHA-1 hash and return 40 byte hexadecimal string.


Hello Buddies  here is the small example of the SHA1 algorithm using Java..

import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class SHADemo {
 private static String convertToHex(byte[] data) {
 StringBuffer buf = new StringBuffer();
 for (int i = 0; i < data.length; i++) {
int halfbyte = (data[i] >>> 4) & 0x0F;
int two_halfs = 0;
do {
if ((0 <= halfbyte) && (halfbyte <= 9))
 buf.append((char) ('0' + halfbyte));
 else
 buf.append((char) ('a' + (halfbyte - 10)));
import java.io.UnsupportedEncodingException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class SHADemo {
 private static String convertToHex(byte[] data) {
 StringBuffer buf = new StringBuffer();
 for (int i = 0; i < data.length; i++) {
int halfbyte = (data[i] >>> 4) & 0x0F;
int two_halfs = 0;
do {
if ((0 <= halfbyte) && (halfbyte <= 9))
 buf.append((char) ('0' + halfbyte));
 else
 buf.append((char) ('a' + (halfbyte - 10)));
 halfbyte = data[i] & 0x0F;
 } while(two_halfs++ < 1);
}
 return buf.toString();
}

public static String SHA1(String text)
throws NoSuchAlgorithmException, UnsupportedEncodingException  {
MessageDigest md;
md = MessageDigest.getInstance("SHA-1");
byte[] sha1hash = new byte[40];
md.update(text.getBytes("iso-8859-1"), 0, text.length());
sha1hash = md.digest();
return convertToHex(sha1hash);
}
public static void main(String ar[]) throws Exception
{
        String sha1_ad1 = SHADemo.SHA1("encryptme");
        System.out.println(sha1_ad1);

}
}
out put is..
99552371f24b195043148eb3e59d9fe84eb7efea

Free Course of Hacking and Cyber Security

As we are into to the world of  internet technology  we need a strong security
for our data. the data might be a email, spam,draft or a scrap. for the security of our credential information as a Software Engineer i want you to go through the following link which will give you the importance of cyber security and why do we need the security for our data. Data64 Techno Solutions offering the free courses.please click on the following link below.

• http://www.data64.com/ 

 for free courses

• http://www.data64.com/free-course-hacking-a-security
• http://www.data64.com/free-course-password-breaking

Data64 Techno Solutions Pvt Ltd is an innovative educational organisation that develops, evaluates and disseminates programs that foster intellectual development and career enhancement. We are a registered company headquartered in Pune - the education capital of India.


Thanks and Regards

Yuvaraj Rajesh Kumar