Skip to main content
This document is for:
Invicti Enterprise on-demand, Invicti Enterprise on-premises

Deploy Invicti Shark for Node.js - Docker

Invicti Shark enables you to carry out interactive security testing (IAST) in your web application to confirm more vulnerabilities and further minimize false positives.

  • Node.js is an open source server environment designed to build scalable network applications, as it's capable of handling a vast number of simultaneous connections with high throughput. Depending on the specific frameworks and libraries, debugging a Node.js application can be tricky though.
  • You can take advantage of Invicti's unique DAST-induced IAST approach to get an inside view into how security checks and test payloads are processed within these environments. These additional insights let you isolate the location and root cause of security defects quickly.

For more information, see Invicti adds IAST support for Node.js.

The most principled way of deploying Invicti Shark in a Docker scenario is to simply layer the Shark modifications onto your already existing container definition.

The following example demonstrates how you can deploy the Shark together with your web application.

Step 1: Download the Shark sensor​

note

For this example, assume that the URL for your target is http://invictiexample.com:60000.

  1. Select Scans > New Scan from the left-side menu.
  2. Choose a Target URL.
  3. From the Scan Settings, choose Shark (IAST and SCA).
  4. Turn on Enable Shark.
  5. From the Server Platform drop-down, choose Nodejs, then Save As.
Download Shark sensor for Node.js

Invicti downloads the following .tar file: Shark(IAST and SCA).tar

info

Change the name of the TAR file into this: SharkNodeJs.tar

Step 2: Define the web application image​

The following file structure defines the simple web application.

/testnodejs-docker/
/testnodejs-docker/Dockerfile
/testnodejs-docker/src/app.js
/testnodejs-docker/src/package.json
  1. Create your /testnodejs-docker/Dockerfile file to read as follows:
FROM node:12

COPY src/ .
RUN npm install

#setup and install Invicti Shark
COPY SharkNodeJs.tar /shark/node-shark.tar
RUN chmod +x /shark/node-shark.tar
# launch the app with Invicti Shark
CMD [ "npx", "/shark/node-shark.tar", "app.js" ]
  1. Create your /testnodejs-docker/src/app.js file to read as follows:
const app = require('express')();
const port = 60000;

app.get('/', function (req, res) {
  res.send(
    '<html><body>' +
    '<h1>Shark(IAST) Example for Node.JS</h1>' +
    '<br>' +
    'Hello World! - Main Page' +
    '<br>' +
    '<a href="/page1">Go to Page 1</a>' +
    '</body></html>'
  );
});
app.get('/page1', function (req, res) {
  res.send(
    '<html><body>' +
    '<h1>Shark(IAST) Example for Node.JS</h1>' +
    '<br>' +
    'Hello World! - Page 1' +
    '<br>' +
    '<a href="/">Go to Main Page</a>' +
    '</body></html>'
  );
});
app.listen(port, function(err){
  if (err) console.log(err);
  console.log("Server listening on port: ", port);
});
  1. Create your /testnodejs-docker/src/package.json file to read as follows:
{
  "name": "testnodejs-docker",
  "version": "1.0.0",
  "dependencies": {
    "express": "*"
  }
}
Docker file structure for Node.js application

Step 3: Build and run the docker image​

  • Build and run your image with:
cd /testnodejs-docker
docker build -t testnodejs-docker .
docker run -d -p 60000:60000 --name mytestnodejs testnodejs-docker
Build and run Docker image

Step 4: Test and scan your web application​

  1. Point your browser to your web application—in this example http://invictiexample.com:60000 to confirm it's running as intended.

  2. Run a scan on your URL. The scan summary displays whether Invicti Shark is used for the scan.

Need help?​

Invicti Support team is ready to provide you with technical help. Go to Help Center

Was this page useful?