Invicti Shark (IAST and SCA)

Deploying Invicti Shark agent for Node.js – AWS Elastic Beanstalk

This document is for:
Invicti Enterprise On-Demand, Invicti Enterprise On-Premises

Invicti Shark enables you to carry out interactive security testing (IAST) in your web application in order to confirm more vulnerabilities and further minimize false positives. 

  • Node.js is an open-source server environment designed to build scalable network applications, as it is capable of handling a vast number of simultaneous connections with high throughput. Depending on the specific frameworks and libraries, debugging a Node.js application can be tricky though.
  • You can take advantage of Invicti’s unique DAST-induced IAST approach to get an inside view into how security checks and test payloads are processed within these environments. These additional insights will let you isolate the location and root cause of security defects quickly.

For further information, Invicti adds IAST support for Node.js.

This article shows you how you can run a Node.js application in AWS Elastic Beanstalk and then use the Shark to run an interactive application security testing (IAST) scan for that application.

Step 1. Adding your website to Invicti Enterprise

For this example, we will assume that the URL for your target is

  1. Add your website to Invicti. For further information, see How to add a website in Invicti Enterprise.
  2. Download the Node.js sensor. For further information, see Downloading Shark sensors in Invicti Enterprise.
  3. Save the Node.js sensor file to use it later on.

Step 2. Creating your application source code bundle

This simple web application will be defined through the following file structure:

~/axexample-nodejs/Shark (IAST and SCA).tar
  • Create your /axexample-nodejs/app.js file to read as follows:
const app = require('express')();
var port = process.env.PORT || 60000;
app.get('/', function (req, res) {
  '<html><body>' +
  '<h1>Test Node.js Site Example for AWS Elastic Beanstalk</h1>' +
  '<br>' +
  'Hello World! - Main Page' +
  '<br>' +
  '<a href="/page1">Goto Page 1</a>' +

app.get('/page1', function (req, res) {
  '<html><body>' +
  '<h1>Test Node.js Site Example for AWS Elastic Beanstalk</h1>' +
  '<br>' +
  'Hello World! - Page 1' +
  '<br>' +
  '<a href="/">Goto Main Page</a>' +

app.listen(port, function(err){
  if (err) console.log(err);
  console.log("Server listening on port: ", port);
  • Create your /axexample-nodejs/package.json file to read as follows:
  "name": "axexample-nodejs",
  "version": "1.0.0",
  "dependencies": {
    "express": "*",
    "node-acusensor": "file:Shark (IAST and SCA).tar"
  "scripts": {
    "start": "npx Shark (IAST and SCA).tar app.js"
  • Copy the Shark (IAST and SCA).tar file you created earlier into ~/axexample-nodejs/Shark (IAST and SCA).tar.
  • Finally, build the source code bundle with:
cd ~/axexample-nodejs
zip -rq
  • Download your file to your desktop and retain your zip file for deployment steps below

Step 3. Deploying your web application to AWS Elastic Beanstalk

  • From your AWS Dashboard, navigate to Elastic Beanstalk>Environments
  • Select Create a new environment 

  • Set your environment tier to Web server environment

  • Click Select
  • On the Elastic Beanstalk Create environment page:
    • Set the Application name field to the name for your web application; for this example, use axexample-nodejs

    • From the Platform drop-down, select Node.js

    • Enable the Upload your code option and select Choose file 

    • Select your Node.js zip source code bundle for upload and select Create environment 

AWS Elastic Beanstalk creates your environment, and this can take a few minutes. When the process is complete you will be sent to your environment’s dashboard

  • Take note of your environment’s new URL which was created automatically by AWS Elastic Beanstalk:
    • You need this to create a CNAME to point to this URL
    • In this example, we would create a CNAME for to point to; here is an example using the Namecheap cPanel interface:

  • Once the CNAME record has been added (giving time for DNS records to propagate), you can see the web application you have created by browsing to your URL (in this example

Step 4. Testing and scanning your web application

  1. Point your browser to your web application – in this example to confirm it is running as intended.
  2. Run a scan on your URL. The scan summary displays whether Invicti Shark is used for the scan.

Invicti Help Center

Our Support team is ready to provide you with technical help.

Go to Help Center This will redirect you to the ticketing system.