Shark for Java

Deploying Invicti Shark for Java – Windows/Linux (Jetty 10.0.10 + WAR file)

This document is for:
Invicti Enterprise On-Demand, Invicti Enterprise On-Premises

This guide explains how you can run a Java application in Jetty and then use Invicti Shark to run an interactive application security testing (IAST) scan for that application.

NOTE: This document assumes that you have Jetty installed in C:\jetty. Change the paths accordingly.

Step 1: Prepare Invicti Shark for Java

In this example, the test application is deployed to the following URL: (in a production environment, you will need to change this to the hostname you will use for your deployment).

  1. Create a new target for your URL.
  2. Download Invicti Shark for Java from the Invicti UI and retain the Shark (IAST and SCA).jar file for the next step. (In our example, Shark (IAST and SCA).jar is saved to C:\shark\). Change the paths accordingly if you are using the Java IAST Sensor on Linux.

Step 2: Prepare your Jetty deployment by installing prerequisites

  1. Launch Jetty from the C:\jetty folder with the parameters required.

 --add-modules=annotations,deploy,ext,http,jsp,logging-jul-capture,resources,server --approve-all-licenses

NOTE: The list of modules might be different for your web application. However, you will need to explicitly add logging-jul-capture if you need logging from the IAST sensor.

C:\jetty>java -jar start.jar --add-modules=annotations,deploy,ext,http,jsp,logging-jul-capture,resources,server --approve-all-licenses

INFO  : All Licenses Approved via Command Line Option

WARN  : creating start.d in ${jetty.home} is not recommended!

Proceed (y/N)? y

INFO  : mkdir ${jetty.base}\start.d

INFO  : webapp          transitively enabled, ini template available with --add-module=webapp

INFO  : ext             initialized in ${jetty.base}\start.d\ext.ini

INFO  : server          initialized in ${jetty.base}\start.d\server.ini

INFO  : logging-jul-capture initialized in ${jetty.base}\start.d\logging-jul-capture.ini

INFO  : servlet         transitively enabled

INFO  : jsp             initialized in ${jetty.base}\start.d\jsp.ini

INFO  : annotations     initialized in ${jetty.base}\start.d\annotations.ini

INFO  : resources       initialized in ${jetty.base}\start.d\resources.ini

INFO  : threadpool      transitively enabled, ini template available with --add-module=threadpool

INFO  : plus            transitively enabled

INFO  : deploy          initialized in ${jetty.base}\start.d\deploy.ini

INFO  : logging-jetty   transitively enabled

INFO  : security        transitively enabled

INFO  : apache-jsp      transitively enabled

INFO  : jndi            transitively enabled

INFO  : http            initialized in ${jetty.base}\start.d\http.ini

INFO  : logging/slf4j   transitive provider of logging/slf4j for logging-jetty

INFO  : logging/slf4j   transitive provider of logging/slf4j for logging-jul-capture

INFO  : logging/slf4j   dynamic dependency of logging-jetty

INFO  : bytebufferpool  transitively enabled, ini template available with --add-module=bytebufferpool

INFO  : mkdir ${jetty.base}\lib\ext

INFO  : download to ${jetty.base}\lib\logging\jul-to-slf4j-2.0.0-alpha6.jar

INFO  : mkdir ${jetty.base}\resources

INFO  : copy ${jetty.base}\modules\logging\jul\resources\ to ${jetty.base}\resources\

INFO  : mkdir ${jetty.base}\webapps

INFO  : copy ${jetty.base}\modules\logging\jetty\resources\ to ${jetty.base}\resources\

INFO  : Base directory was modified


Step 3: Deploy Invicti Shark and the required components

  1. Using a text editor, edit the contents of the C:\jetty\resources\ file to read as follows:

## Set logging levels from: ALL, TRACE, DEBUG, INFO, WARN, ERROR, OFF




  1. Using a text editor, edit the contents of the C:\jetty\resources\ file to read as follows:




com.invicti.handlers = org.slf4j.bridge.SLF4JBridgeHandler

com.invicti.level = FINEST

java.util.logging.SimpleFormatter.format=%4$s: %5$s [%1$tc]%n

  1. Using a text editor, create a file C:\jetty\start.d\start.ini
  2. Edit the contents of the C:\jetty\start.d\start.ini file to read as follows:


-javaagent:C:\shark\Shark (IAST and SCA).jar


Step 4: Deploy your application and start the Jetty server

  1. Once you are ready, from the command line, navigate to your C:\jetty folder, and launch Jetty:

C:\jetty> java -jar start.jar

Step 5: Test and scan your web application

  1. Point your browser to your web application to confirm it is running as intended.
  2. Run a scan on your target website URL. The scan summary will confirm that Invicti Shark was detected and used for the scan.

Invicti Help Center

Our Support team is ready to provide you with technical help.

Go to Help Center This will redirect you to the ticketing system.