Deploying Invicti Shark for Java – Tomcat (Windows/Linux/Docker)
Invicti Shark Network Prerequisites Invicti Shark makes use of the Invicti IAST Bridge. For more information, refer to Configuring Invicti IAST Bridge. |
- The Invicti Shark agent for Java requires Tomcat (8.5+) and Java (8+).
- The Invicti Shark agent will need to be deployed to your web application. This guide shows you how to deploy Invicti Shark to a Java web application.
IMPORTANT: The following installation instructions are for the newer version of the Java IAST sensor. If you are running the older, aspectjweaver-based Java sensor, you need to remove the old sensor before proceeding with installing the newer version of the Java sensor. Instructions on how to check if you are using the older version of the Java sensor and how to remove it can be found at the end of this document. |
How to deploy Invicti Shark into your web server
- Download the Java Invicti Shark agent (Shark (IAST and SCA).jar) from the Invicti UI. The Java Invicti Shark download file includes the Invicti Shark Token, which is unique by default for each target website URL. Unless the Token has been changed to be the same for all target websites, you will need to download the Java Invicti Shark agent for each target website separately. You will also need to adjust your Invicti Shark password to use a single Shark agent for the entire web server.
- Save the downloaded Java Invicti Shark agent to a location on your web server (e.g. C:\JAVA_InvictiShark or /usr/share/JAVA_InvictiShark).
- Configure Tomcat to load the Java Invicti Shark agent.
- Windows: This can be done from the Apache Tomcat Configuration > Java tab > Java Options. Add 2 parameters into the Apache Tomcat Configuration > Java Options section:
- -javaagent:C:\JAVA_Shark\Shark (IAST and SCA).jar (mandatory; adjust the path depending on where you saved the Shark (IAST and SCA).jar file)
- -Dacusensor.debug.log=ON (optional; enables debug logging and should only be used for troubleshooting)
- Linux: This can be done from /usr/share/tomcat9/bin/setenv.sh in the JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/share/java/Shark (IAST and SCA).jar -Dacusensor.debug.log=ON"
- Restart the Tomcat service.
NOTE: The parameter "-Dacusensor.debug.log=ON" is optional, and can be omitted. If this parameter is retained, this will output the Shark logging as additional lines in the Tomcat logs starting with "[Invicti-debug]". |
How to disable and remove Invicti Shark for Java
To remove and disable the sensor from your website, you need to revert the changes done during the deployment of the Agent:
- Stop the Tomcat service.
- Remove the Invicti Java Shark (Shark (IAST and SCA).jar) from the folder where it was saved.
- Reconfigure Tomcat so that it does not load the javaagent by removing the -javaagent and -Dshark.debug.log parameters.
- Windows: This can be done from the Apache Tomcat Configuration > Java tab > Java Options section.
- Linux: This can be done from /usr/share/tomcat9/bin/setenv.sh by removing the line JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/share/java/Shark (IAST and SCA).jar -Dacusensor.debug.log=ON"
- Restart the Tomcat service.
NOTE: Although the Invicti Shark agent is secured with a strong password, it is recommended that the Shark client files are uninstalled and removed from the web application if they are no longer in use. |
How to disable and remove older versions of Shark for Java
Older versions of Shark for Java made use of aspectjweaver to provide the IAST functionality. You can confirm if you are using the aspectjweaver-based Java sensor from the Apache Tomcat Configuration > Java tab > Java Options section. If the -javaagent option is loading aspectjweaver.jar, then you need to remove the older Shark for Java using the following instructions:
- Remove Invicti Java Shark (Shark (IAST and SCA).jar) from the folder or folders where it was deployed.
- Remove aspectjweaver.jar from the folder where it was copied to.
- Reconfigure Tomcat with Load Time Weaving disabled, as follows:
- Remove the -javaagent and -Dshark.debug.log parameters in the Apache Tomcat Configuration > Java tab > Java Options section.
- Restart the Tomcat service.