Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Application Security Platform
Invicti IAST for JAVA

Invicti IAST Agent for Java – Tomcat (Windows/Linux/Docker)

This document is for:
Invicti Platform

Invicti IAST Network Prerequisites

Invicti IAST makes use of the IAST Bridge. The IAST sensor must be able to communicate with iast.invicti.com to transmit data to the DAST scanning engine.

  • Invicti IAST for JAVA requires Tomcat (8.5+) and Java (8+).
  • The Invicti IAST agent will need to be deployed to your web application.

This document explains how to deploy Invicti IAST to a Java web application.

The following installation instructions are for the newer version of the Invicti Java IAST sensor. If you are running the older, aspectjweaver-based Java sensor, you must remove the old sensor before installing the newer version. Instructions on how to check if you are using the older version of the Invicti Java IAST sensor and how to remove it can be found at the end of this document.

How to deploy Invicti IAST into your web server

To install the Invicti Java IAST sensor, you need to:

  1. Download the Invicti Java IAST agent (iastsensor.jar) from the Target’s Settings in the Invicti Platform UI.
    The Invicti IAST for JAVA download includes the Invicti IAST Token which, by default, is unique for each target. Unless the Token has been changed to be the same for all the targets, you will need to download the Invicti Java IAST sensor for each Target separately. You will need to adjust your Invicti IAST password to use a single Invicti IAST agent for the entire web server.
  2. Save the downloaded Invicti Java IAST sensor to a location on your web server (e.g. C:\JAVA_iastsensor or /usr/share/JAVA_iastsensor).

  1. Tomcat needs to be configured to load the Invicti Java IAST sensor.

  1. On Windows, this can be done from the Apache Tomcat Configuration > Java tab > Java Options. Add 2 parameters into the Apache Tomcat Configuration > Java Options section:

  • -javaagent:C:\JAVA_iastsensor\iastsensor.jar (mandatory; adjust the path depending on where you saved the iastsensor.jar file)

  • -Diastsensor.debug.log=ON (optional; enables debug logging and should only be used for troubleshooting)


  1. On Linux, this can be done from /usr/share/tomcat9/bin/setenv.sh in the JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/share/java/iastsensor.jar -Diastsensor.debug.log=ON"

  1. Restart the Tomcat service.

The parameter "-Diastsensor.debug.log=ON" is optional, and can be omitted. If this parameter is retained, this will output Invicti IAST logging as additional lines in the Tomcat logs starting with "[Invicti-debug]".

How to disable and remove Invicti IAST for Java

To remove and disable the sensor from your website, you need to revert the changes made during the deployment of the Agent:

  1. Stop the Tomcat service.

  1. Remove the Invicti Java IAST sensor (iastsensor.jar) from the folder where it was saved.

  1. Reconfigure Tomcat so that it does not load the javaagent by removing the -javaagent and -Diastsensor.debug.log parameters.

  1. On Windows, this can be done from the Apache Tomcat Configuration > Java tab > Java Options section.

  1. On Linux, this can be done from /usr/share/tomcat9/bin/setenv.sh by removing the line JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/share/java/iastsensor.jar -Diastsensor.debug.log=ON"

  1. Restart the Tomcat service.

Although the Invicti IAST agent is secured with a strong password, it is recommended that the Invicti IAST client files be uninstalled and removed from the web application if they are no longer in use.

How to disable and remove older versions of Invicti IAST for Java

Older versions of Invicti IAST for Java made use of aspectjweaver to provide the IAST functionality. You can confirm if you are using the aspectjweaver-based Java sensor from the Apache Tomcat Configuration > Java tab > Java Options section. If the -javaagent option is loading aspectjweaver.jar, then you need to remove the older Invicti IAST for Java using the following instructions:

  1. Remove Invicti Java IAST sensor (iastsensor.jar) from the folder or folders where it was deployed.

  1. Remove aspectjweaver.jar from the folder where it was copied to.

  1. Reconfigure Tomcat with Load Time Weaving disabled, as follows:

  1. Remove the -javaagent and -Diastsensor.debug.log parameters in the Apache Tomcat Configuration > Java tab > Java Options section.

  1. Restart the Tomcat service.

Top Articles

What is Invicti?

Overview of Scan Policies

Scheduling Scans

Managing Integrations

Built-In Reports

Share This Article