Deploying the AcuSensor agent for Java - Centos 8.1 & RHEL 8.1 in Acunetix 360

You can use AcuSensor to carry out interactive security testing (IAST) in your web application to confirm more vulnerabilities and further minimize false positives.

For AcuSensor to operate, you need to download an agent and deploy it on your server. Please note that this agent is generated uniquely for each target website for security reasons.

This topic explains how to download and deploy AcuSensor to a Java web application.

if_Gnome-Dialog-Information-64_55568.png

Information

AcuSensor for Java requires Tomcat (7+) and Java (1.7+). Current testing is with Tomcat 9 and Java 1.8.

if_Gnome-Dialog-Information-64_55568.png

Information

This topic assumes the following:

  • The Tomcat 9 zip file was installed directly into /opt/apache-tomcat-9.0.31 with a symlink /opt/tomcat9 pointing to this installation folder.
  • The official RPM file jre-8u241-linux-x64.rpm from Oracle was used to install the JRE using command line: dnf install jre-8u241-linux-x64.rpm
  • You are using version 1.9.5 (latest at time of writing) of AspectJWeaver.

Deploying AcuSensor in Java consists of 3 steps:

  1. Deploying AspectJWeaver into your web application

  1. Open terminal
  2. Run the following commands to download and deploy AspectJWeaver:
  1. wget -c https://repo1.maven.org/maven2/org/aspectj/aspectjweaver/1.9.5/aspectjweaver-1.9.5.jar 
  2. sudo mv aspectjweaver-1.9.5.jar /opt/tomcat9/lib
  3. sudo ln -s /opt/tomcat9/lib/aspectjweaver-1.9.5.jar /opt/tomcat9/lib/aspectjweaver.jar

  1. Deploying AcuSensor into your web application

  1. Download the AcuSensor for Java
  2. Copy AcuSensor (acusensor.jar) to %TOMCAT-HOME%\lib - based on the assumptions above, you would copy the acusensor.jar file to /opt/tomcat9/lib

  1. Configure Tomcat to use AspectJWeaver and AcuSensor

  • Launch Tomcat with Load Time Weaving enabled. This can be done by adding a -javaagent parameter with the path to aspectjweaver.jar when launching Tomcat, and optionally a parameter to enable AcuSensor debug logging

  • For Centos 8.1 and RHEL 8.1, add two parameters into the Tomcat setenv.sh script (normally you will be creating a new file):
  • Run the following command: sudo nano /opt/tomcat9/bin/setenv.sh
  • At the end of the file, add the line JAVA_OPTS="$JAVA_OPTS -javaagent:$CATALINA_HOME/lib/aspectjweaver.jar -Dacusensor.debug.log=ON"
  • Save the file
  • Run the following command: sudo systemctl restart tomcat9

if_Gnome-Dialog-Information-64_55568.png

Information

The parameter "-Dacusensor.debug.log=ON" is optional and should ONLY be used for troubleshooting purposes. If this parameter is retained, this will output AcuSensor logging as additional lines in the Tomcat logs starting with "[Acunetix-debug]".

Disabling and Removing AcuSensor for Java

To remove and disable the sensor from your website, you need to revert the changes done during the deployment of the Agent. Based on the assumptions above:

  • Remove the AcuSensor (AcuSensor.jar) from the folder where it was deployed with:
  • rm /opt/tomcat9/lib/acusensor.jar
  • Remove aspectjweaver.jar with:
  • sudo rm /opt/tomcat9/lib/aspectjweaver.jar
  • sudo rm /opt/tomcat9/lib/aspectjweaver-1.9.5.jar
  • Reconfigure Tomcat with Load Time Weaving disabled:
  • remove the "JAVA_OPTS" line added earlier in the setenv.sh file
  • run the following command: sudo systemctl restart tomcat9

if_Gnome-Dialog-Information-64_55568.png

Information

Although the AcuSensor agent is secured with a strong password, it is recommended that the AcuSensor client files are uninstalled and removed from the web application if they are no longer in use.


 
« Back to the Acunetix Support Page