Skip to main content
This document is for:
Invicti Enterprise on-demand, Invicti Enterprise on-premises

Deploy Invicti Shark for Java - AWS Elastic Beanstalk (Tomcat + WAR File)

This document shows you how to run a Java application in AWS Elastic Beanstalk and then use Invicti Shark to run an interactive application security testing (IAST) scan for that application.

Important

The following installation instructions are for the newer version of the Java IAST sensor. If you are running the older, aspectjweaver-based Java sensor, you need to remove the old sensor and any reference to aspectjweaver.jar from the JVM Options before proceeding with installing the newer version of the Java sensor.

Prerequisites​

  • Install Java.
  • Install Eclipse IDE for Enterprise Java and Web Developers.
  • Install Eclipse Extensions from "Web, XML, Java EE and OSGI Enterprise Development":
    • Eclipse Java EE Developer Tools
    • Eclipse Java Web Developer Tools
    • Eclipse Web Developer Tools
    • JST Server Adapters Extensions (Apache Tomcat)

Step 1: Prepare an example application using Eclipse IDE​

  1. Go to File > New > Project.
  2. In the New Project wizard, search for and choose the Dynamic Web Project option, then click Next.
  3. Set the Project name field to axexample-java.
  4. Set the Target runtime field to Apache Tomcat v8.5.
  5. Set the Dynamic web module version field to 3.1.
  6. Set the Configuration field to Default Configuration for Apache Tomcat v8.5.
  7. Click Next.
Project settings for the example application.
  1. In the Java window, leave the default settings and click Next.
  2. In the Web Module window, enable the Generate web.xml option and click Finish.
Generate web.xml in IDE.
  1. In the Open Associated Perspective? dialog, click No.
  2. Expand the axexample-java project.
  3. Right-click the src folder.
  4. Choose New > Other.
  5. Highlight the Servlet option.
  6. Click Next.
  7. Set the Java package field to com.mytest.axexample.
  8. Set the Class name field to axExampleJavaServlet.
  9. Click Finish.
Create servlet settings.
  1. Edit the contents of the axExampleJavaServlet.java file to read as follows:
package com.mytest.axexamplejava;

import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * Servlet implementation class HelloWorldServlet
 */
@WebServlet("/axExampleJavaServlet")
public class axExampleJavaServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;
    
    /**
     * @see HttpServlet#HttpServlet()
     */
    public axExampleJavaServlet() {
        super();
        // TODO Auto-generated constructor stub
    }
    
    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        PrintWriter out = response.getWriter();
        out.print("<html><body><h1>Test JAVA Site Example for AWS Elastic Beanstalk</h1><br>Welcome to the main page.<br></body></html>");
    }
    
    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // TODO Auto-generated method stub
        doGet(request, response);
    }
}
  1. Expand the axexample-java project, right-click the axexample-java/src/main/webapp folder, and choose New > File.
  2. Set the filename to index.html and click Finish.
  3. Edit the contents of the index.html file to read as follows:
<head>
<title>Test JAVA Site Example for AWS Elastic Beanstalk</title>
</head>
<body>
<h1>Test JAVA Site Example for AWS Elastic Beanstalk</h1><br/><br/>
<a href="axExampleJavaServlet">Click here to invoke servlet</a>
</body>
</html>
  1. Make sure that the changes to both new files are saved.
  2. Right-click the axexample-java project, click the Export option, search for the WAR file option, and choose it.
  3. Click Next and choose a Destination for your exported WAR file.
  4. Ensure that the filename for your export file is ROOT.war.
  5. Click Finish.

Step 2: Prepare Invicti Shark for Java​

The test application is deployed to the following URL: http://eb.acunetixexample.com - you need to change this to the hostname you use for your test deployment.

  1. Create a new target website for this URL, replacing http://eb.acunetixexample.com with the URL for your chosen hostname. For more information, refer to the How to add a website in Invicti Enterprise document.
  2. Download Invicti Shark for Java from the Invicti UI and retain the Shark (IAST and SCA).jar file for the next step.

Step 3: Prepare a folder for your source code bundle​

  1. Create a folder C:\axexample-java
  2. Create a folder C:\axexample-java\.ebextensions
  3. Copy your exported ROOT.war file into C:\axexample-java
  4. Copy your Shark (IAST and SCA).jar file into C:\axexample-java\.ebextensions
  5. Using a text editor, create a file C:\axexample-java\.ebextensions\invictishark.config
  6. Edit the contents of the C:\axexample-java\.ebextensions\invictishark.config file to read as follows:
commands:
  01_create_shark_directory:
    command: "mkdir -p /home/shark"

option_settings:
  aws:elasticbeanstalk:container:tomcat:jvmoptions:
    JVM Options: '-javaagent:/home/shark/Shark (IAST and SCA).jar -Dacusensor.debug.log=ON'

container_commands:
  01_copy_shark:
    command: "cp .ebextensions/Shark (IAST and SCA).jar /home/shark/Shark (IAST and SCA).jar"
  02_change_shark_dir_permissions:
    command: "sudo chown -R root:root /home/shark"

note

The parameter -Dacusensor.debug.log=ON is optional, and should ONLY be used for troubleshooting purposes. If this parameter is retained, this outputs Invicti Shark logging as additional lines in the Tomcat logs starting with [Shark-debug].

  1. Use Windows Explorer to navigate to C:\axexample-java; press CTRL+A to select both .ebextensions and ROOT.war.
  2. Right-click the selected items and click Send to > Compressed (zipped) folder.
  3. Rename your zip file to axexample-java.zip and retain your zip file for the deployment steps.

Step 4: Deploy the web application to AWS Elastic Beanstalk​

  1. From your AWS Dashboard, navigate to Elastic Beanstalk > Environments.
  2. Choose Create a new environment.
Create a new environment.
  1. Set your environment tier to Web server environment, then click Select.
  2. Set the Application name field to the name of your web application. In this example the name is axexample-java.
  3. Set the Platform drop-down to Tomcat.
Tomcat platform settings.
  1. Enable the Upload your code option and click Choose file.
Upload your code to AWS.
  1. Choose your axexample.zip source code bundle for upload and click Create environment. AWS Elastic Beanstalk creates your environment. This can take a few minutes.
  2. When the process is complete, you're sent to your environment's dashboard.
Environment dashboard
  1. Take note of your environment's new URL which was created automatically by AWS Elastic Beanstalk:
    • You need this to create a CNAME to point to this URL.
    • In this example, create a CNAME for eb.acunetixexample.com to point to axexamplejava-env.eba-y3m5stqv.us-east-1.elasticbeanstalk.com. Here is an example using the Namecheap cPanel interface.
CNAME record configuration
  1. Once the CNAME record has been added (giving time for DNS records to propagate), you can see the web application you have created by browsing to your URL (in this example http://eb.acunetixexample.com).

Step 5: Test and scan your web application​

  • Point your browser to your web application—in this example, http://eb.acunetixexample.com to confirm it's running as intended.
  • Run a scan on your URL. The scan summary confirms that Invicti Shark was detected and used for the scan.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?