Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Support
Invicti Shark (IAST and SCA)

Deploying Invicti Shark (IAST) for JAVA – Linux (Wildfly 26.1.1.Final Standalone + WAR file)

This document is for:
Invicti Enterprise On-Demand, Invicti Enterprise On-Premises

The following article shows you how you can run a Java application in Wildfly and then use Invicti Shark (IAST) to run an interactive application security testing (IAST) scan for that application.

This document was tested running Wildfly on Debian 11 using the default-jdk package.
This document assumes wildfly is installed in /opt/wildfly, so the variable %JBOSS_HOME% in this document would also mean /opt/wildfly.

Prerequisites

  • Install JAVA
  • Install Eclipse IDE for Enterprise JAVA and Web Developers
  • Install Eclipse Extensions from “Web, XML, Java EE, and OSGI Enterprise Development”:
    • Eclipse Java EE Developer Tools
    • Eclipse Java Web Developer Tools
    • Eclipse Web Developer Tools
    • JST Server Adapters Extensions (Apache Tomcat)

Step 1: Preparing an example application using Eclipse IDE

Creating your application

  1. Launch Eclipse IDE.
  2. From the menu, go to File > New > Project.
  1. On the New Project wizard, search for and select Dynamic Web Project.
  2. Select Next.
  3. On the Dynamic Web Project, do the following:
    1. Set the Project name field to axexample-java
    2. Set the Target runtime field to Apache Tomcat v8.5 
    3. Set the Dynamic web module version field to 3.1 
    4. Set the Configuration field to Default Configuration for Apache Tomcat v8.5
  1. Select Next.
  2. On the Java window, leave the default settings as they are.
  3. Select Next.
  4. On the Web Module step, enable Generate web.xml deployment descriptor.
  1. Select Finish.
  2. On the Open Associated Perspective? dialog, select No.
  3. Expand the axexample-java project 
  4. Right-click on the src folder 
  5. Select New > Other.
  6. Highlight Servlet.
  1. Select Next.
  2. On the Create Servlet window, do the following:
    • Set the Java package field to com.mytest.axexample.
    • Set the Class name field to axExampleJavaServlet.
  1. Select Finish.
  2. Edit the contents of the axExampleJavaServlet.java file to read as follows:

package com.mytest.axexample;

import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet implementation class HelloWorldServlet
 */
@WebServlet("/axExampleJavaServlet")
public class axExampleJavaServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;
       
    /**
     * @see HttpServlet#HttpServlet()
     */
    public axExampleJavaServlet() {
        super();
        // TODO Auto-generated constructor stub
    }

	/**
	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		PrintWriter out = response.getWriter();
		out.print("<html><body><h1>Test JAVA Site Example for Wildfly</h1><br>Welcome to the main page.<br></body></html>");
	}

	/**
	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
	 */
	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		// TODO Auto-generated method stub
		doGet(request, response);
	}
}
  1. Expand the axexample-java project, right-click on the axexample-java/src/main/webapp folder, and select New > File.
  1. Set the filename to index.html and select Finish. 
  2. Edit the contents of the index.html file to read as follows:
<html>
  <head>
    <title>Test JAVA Site Example for Wildfly</title>
  </head>
  <body>
    <h1>Test JAVA Site Example for Wildfly</h1><br/><br/>
    <a href="axExampleJavaServlet">Click here to invoke servlet</a> 
  </body>
</html>
  1. Make sure that the changes to both new files are saved.
  2. Right-click on the axexample-java project, select Export…, search for the WAR file option and select it.
  1. Select Next, then choose a destination for your exported WAR file.
  1. Ensure that the filename for your export file is axexample-java.war 
  2. Select Finish.

Step 2: Preparing Invicti Shark for Java

We deploy the test application to the following URL: http://wildfly-backend-proto.invicti.site:8080/axexample-java/ (In a production environment, you need to change this to the hostname you will use for your deployment.) 

  1. Create a new target for your URL.
  2. Download Invicti Shark for Java. 
  3. Retain the Shark(IASTandSCA).jar file for the next step.

Step 3: Preparing a folder for the AspectJWeaver component

On the Wildfly machine:

  1. Create a root folder /aspectjweaver
  2. Download AspectJWeaver from https://repo1.maven.org/maven2/org/aspectj/aspectjweaver/1.9.7/aspectjweaver-1.9.7.jar
  3. Copy the downloaded file into /aspectjweaver/aspectjweaver-1.9.7.jar

Step 4: Deploying Invicti Shark and required components

On the Wildfly machine:

  1. Create a folder %JBOSS_HOME%/modules/system/layers/base/com/invicti
  2. Create a folder %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor
  3. Create a folder %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor/main
  4. Copy your Shark(IASTandSCA).jar file into %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor/main/shark(iastandsca).jar (note lowercase to avoid issues with case sensitivity.)
  5. Using a text editor, create a file %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor/main/module.xml
  6. Edit the contents of the %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor/main/module.xml file to read as follows:
<?xml version="1.0" encoding="UTF-8"?>
<module name="com.invicti.sensor" xmlns="urn:jboss:module:1.9">
  <resources>
    <resource-root path="shark(iastandsca).jar"/>
    <resource-root path="aspectjrt-1.9.7.jar"/>
  </resources>
  <dependencies>
    <module name="javax.api"/>
    <module name="javax.servlet.api"/>
    <module name="java.logging"/>
    <module name="org.jboss.modules"/>
  </dependencies>
</module>
  1. Download AspectJRT from https://repo1.maven.org/maven2/org/aspectj/aspectjrt/1.9.7/aspectjrt-1.9.7.jar
  2. Copy the aspectjrt-1.9.7.jar file into %JBOSS_HOME%/modules/system/layers/base/com/invicti/sensor/main
  3. Prepare a custom configuration for Invicti Shark (IAST) integration: 
cp /opt/wildfly/standalone/configuration/standalone.xml /opt/wildfly/standalone/configuration/standalone-invicti.xml
  1. Using a text editor, edit the contents of the %JBOSS_HOME%/standalone/configuration/standalone-invicti.xml file by adding the highlighted lines below immediately below the line <subsystem xmlns=”urn:jboss:domain:ee:6.0″>:
...
...
        </subsystem>
        <subsystem xmlns="urn:jboss:domain:ee:6.0">
            <global-modules>
                <module name="com.invicti.sensor" slot="main"/>
            </global-modules>
            <spec-descriptor-property-replacement>false</spec-descriptor-property-replacement>
            <concurrent>
...
...
  1. Edit the contents of the %JBOSS_HOME%/bin/standalone.conf file and add the following to the bottom of the file:
# *** Invicti Shark settings
JAVA_OPTS="$JAVA_OPTS -Dacusensor.debug.log=ON"
MODULE_OPTS="-javaagent:/aspectjweaver/aspectjweaver-1.9.7.jar"

Step 5: Deploying your application

Copy your axexample-java.war file into the %JBOSS_HOME%/standalone/deployments folder.

Step 6: Starting your Wildfly server

Option 1 – Launch Wildfly manually

From the terminal, launch Wildfly specifying the custom config file created earlier:

admin@ip-172-27-240-198:~$ sudo /opt/wildfly/bin/standalone.sh --server-config=standalone-invicti.xml
=========================================================================

  JBoss Bootstrap Environment

  JBOSS_HOME: /opt/wildfly

  JAVA: java

  JAVA_OPTS: -javaagent:"/opt/wildfly/jboss-modules.jar"  -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Dacusensor.debug.log=ON  --add-exports=java.desktop/sun.awt=ALL-UNNAMED --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.management/javax.management=ALL-UNNAMED --add-opens=java.naming/javax.naming=ALL-UNNAMED

=========================================================================

...

Option 2 – Use the systemd service launcher

  1. Edit the wildfly main configuration file, typically in /etc/wildfly/wildfly.conf and change the WILDFLY_CONFIG and WILDFLY_MODE lines to read as follows:
# The configuration you want to run
WILDFLY_CONFIG=standalone-invicti.xml

# The mode you want to run
WILDFLY_MODE=standalone
...
  1. Restart the Wildfly service with: 
sudo systemctl restart wildfly

Step 7: Testing and scanning your web application

Point your browser to your web application to confirm it is running as intended; you will get the following:

Finally, run a scan on your target.

Top Articles

What is Invicti?

Overview of Scan Policies

Scheduling Scans

Managing Integrations

Built-In Reports

Invicti Help Center

Our Support team is ready to provide you with technical help.

Go to Help Center This will redirect you to the ticketing system.