Installing the AcuSensor agent for JAVA websites

Acunetix JAVA Acusensor requires Tomcat (7+) and Java (1.7+). Current testing is with Tomcat 9 and Java 1.8.

The AcuSensor agent will need to be installed in your web application. This section describes how to install AcuSensor in a JAVA web application.

The Java AcuSensor requires:

  1. Installing aspectjweaver.jar into your web server - provides the integration required for AcuSensor to work with your application
  2. Installing the Acunetix Java AcuSensor into your web server - this is unique for each Target, and can be downloaded by using the Download JAVA AcuSensor button
  3. Configuring your web server to use Load Time Weaving (AspectJWeaver)

Assumptions for this document

Note: Since your docker container can be built from a variety of different templates, the file locations (path) may be different. This document assumes:

  • the docker container was built with "FROM tomcat:9.0-alpine".
  • the docker container name is "mycontainer" - you will have to substitute with your docker container's name

Note: This document assumes that you will be using version 1.9.5 (latest at time of writing) of AspectJWeaver.

Deploying AspectJWeaver into your installation - Windows

Deploying AspectJWeaver into your installation - Ubuntu Linux

  • Run the following command: sudo apt install libaspectj-java

Deploying AspectJWeaver into your installation - Centos 8.1 and RHEL 8.1

Note: Since there are no packages in the official repositories to install Tomcat 9, this document assumes that the Tomcat 9 zip file was installed directly into /opt/apache-tomcat-9.0.31 with a symlink /opt/tomcat9 pointing to this installation folder.

Note: This document assumes that the official RPM file jre-8u241-linux-x64.rpm from Oracle was used to install the JRE using command line: dnf install jre-8u241-linux-x674.rpm

To download and install AspectJWeaver, run the following commands:

Deploying AspectJWeaver into your installation - Docker Container

To download and install AspectJWeaver, run the following commands:

Deploying AcuSensor into your installation

  • Download the Acunetix JAVA AcuSensor from the Acunetix UI
  • Copy the Acunetix JAVA AcuSensor (AcuSensor.jar) to %TOMCAT-HOME%\lib
  1. If installing on Ubuntu 18.04.3 where Tomcat 9 was installed using the regular Ubuntu repositories to install tomcat and needed components (sudo apt install tomcat9 libaspectj-java), copy the AcuSensor.jar file to /usr/share/tomcat9/lib
  2. If installing on Centos 8.1 or RHEL8.1, copy the AcuSensor.jar file to /opt/tomcat9/lib
  3. If installing on Windows where Tomcat 9 was installed using the official "32-bit/64-bit Windows Service Installer", copy the AcuSensor.jar file to C:\Program Files (x86)\Apache Software Foundation\Tomcat 9.0\lib
  4. If installing on Spring Framework, copy the AcuSensor.jar file to %TOMCAT-HOME%\webapps\app-under-test\WEB-INF\lib
  5. If installing in a docker container, copy the AcuSensor.jar file to /usr/local/tomcat/lib/ using the command:
  1. docker cp AcuSensor.jar mycontainer:/usr/local/tomcat/lib/

Configure Tomcat to use AspectJWeaver and AcuSensor

  • Launch Tomcat with Load Time Weaving enabled. This can be done by adding a -javaagent parameter with the path to aspectjweaver.jar when launching Tomcat.
  1. For Windows, you will need to add 2 parameters into the Apache Tomcat Configuration > JAVA options tab
  1. -javaagent:C:\Program Files (x86)\Apache Software Foundation\Tomcat 9.0\lib\aspectjweaver.jar (mandatory; adjust path depending on where you installed the aspectjweaver.jar file)
  2. -Dacusensor.debug.log=ON (optional; enables debug logging)

  1. restart the Tomcat service
  1. For Ubuntu 18.04.3 where Tomcat 9 was installed using the regular Ubuntu repositories to install tomcat and needed components (sudo apt install tomcat9 libaspectj-java), you will need to add 2 parameters into the Tomcat setenv.sh script (normally you will be creating a new file):
  1. run the command: sudo nano /usr/share/tomcat9/bin/setenv.sh
  2. at the end of the file, add the line: JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/share/java/aspectjweaver.jar -Dacusensor.debug.log=ON"
  3. save the file
  4. run the command: sudo systemctl restart tomcat9
  1. For Centos 8.1 and RHEL 8.1, you will need to add 2 parameters into the Tomcat setenv.sh script (normally you will be creating a new file):
  1. run the command: sudo nano /opt/tomcat9/bin/setenv.sh
  2. at the end of the file, add the line: JAVA_OPTS="$JAVA_OPTS -javaagent:$CATALINA_HOME/lib/aspectjweaver.jar -Dacusensor.debug.log=ON"
  3. save the file
  4. run the command: sudo systemctl restart tomcat9
  1. For a docker container, you will need to add 2 parameters into the Tomcat setenv.sh script - this assumes that this file does not exist within the docker container:
  1. run the command: nano setenv.sh
  2. at the end of the file, add the line: JAVA_OPTS="$JAVA_OPTS -javaagent:/usr/local/tomcat/lib/aspectjweaver.jar -Dacusensor.debug.log=ON"
  3. save the file
  4. move the file into the docker container:
  1. docker cp setenv.sh mycontainer:/usr/local/tomcat/bin/
  1. restart the container: docker restart mycontainer

Note: The parameter "-Dacusensor.debug.log=ON" is optional, and can be omitted. If this parameter is retained, this will output AcuSensor logging as additional lines in the Tomcat logs starting with "[Acunetix-debug]".


Docker Automation for JAR Applications

This is an example Dockerfile you can use to test your JAR springboot webapp keeping all files in the same location within the docker container:

FROM openjdk:8-jdk-alpine

COPY AcuSensor.jar AcuSensor.jar

COPY aspectjweaver.jar aspectjweaver.jar

COPY app.jar app.jar

EXPOSE 8080

CMD java -javaagent:aspectjweaver.jar -Dacusensor.debug.log=ON -Dloader.path=AcuSensor.jar -cp app.jar  org.springframework.boot.loader.PropertiesLauncher

Disabling and Uninstalling AcuSensor for JAVA

To uninstall and disable the sensor from your website you need to revert the changes done during the installation of the Agent.:

  1. Remove the Acunetix JAVA AcuSensor (AcuSensor.jar) from the folder where it was installed. In the case of a docker environment, run the command:
  1. docker exec mycontainer rm /usr/local/tomcat/lib/AcuSensor.jar
  1. Remove aspectjweaver.jar:
  1. Under Windows, remove aspectjweaver.jar from the folder where it was copied to
  2. Under Ubuntu Linux, run the command: sudo apt remove libaspectj-java
  3. Under Centos 8.1 and RHEL 8.1, run the commands:
  1. sudo rm /opt/tomcat9/lib/aspectjweaver.jar
  2. sudo rm /opt/tomcat9/lib/aspectjweaver-1.9.5.jar
  1. In a docker environment, run the commands:
  1. docker exec mycontainer rm /usr/local/tomcat/lib/aspectjweaver.jar
  1. Reconfigure Tomcat with Load Time Weaving disabled:
  1. Under Windows, this can be done as follows:
  1. remove the -javaagent and -Dacusensor.debug.log parameters in the Apache Tomcat Configuration > JAVA options tab
  2. restart the Tomcat service
  1. Under Ubuntu 18.04.3, Centos 8.1, and RHEL 8.1 this can be done as follows:
  1. remove the "JAVA_OPTS" line added earlier in the setenv.sh file
  2. run the command: sudo systemctl restart tomcat9
  1. In a docker environment, run the commands:
  1. docker exec mycontainer rm /usr/local/tomcat/bin/setenv.sh
  2. docker restart mycontainer

Note: Although the Acunetix AcuSensor agent is secured with a strong password, it is recommended that the AcuSensor client files are uninstalled and removed from the web application if they are no longer in use.

 

« Back to the Acunetix Support Page