Dongtai IAST is an open-source Interactive Application Security Testing (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation. It is particularly suitable for use in the testing phase of the development pipeline.
[X] I agree to follow the Code of Conduct that this project adheres to.
[X] I have searched the issue tracker for an issue that matches the one I want to file, without success.
[X] I am not looking for support or already pursued the available support channels without success.
Version
1.8.3
Installation Type
Official Docker Compose
Service Name
DongTai-agent-java
Describe the details of the bug and the steps to reproduce it
[root@localhost jetty-home-12.0.13]# java -javaagent:/root/DongTai/iast-tool/dongtai-agent.jar -Dproject.name=jetty -jar /root/DongTai/iast-tool/jetty-home-12.0.13/start.jar --add-modules=server --jetty.base=/root/DongTai/iast-tool/jetty-base
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] DongTai Config: /tmp/DemoProject-v1.0.0-43d07341e6b84e9da362204257007aca/iast/iast.properties
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] fluent extract success.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] Agent registered successfully.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-spy was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-core was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-api was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-grpc was successfully written to the local cache.
Java HotSpot(TM) 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Engine is successfully installed to the JVM, and it takes 1 s
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Agent Version: v1.7.5, DongTai Server: http://192.168.201.190/openapi
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] Turn on the engine
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai engine start successfully.
WARN : creating start.d in ${jetty.home} is not recommended!
Proceed (y/N)? y
INFO : mkdir ${jetty.base}/start.d
INFO : server initialized in ${jetty.base}/start.d/server.ini
INFO : logging-jetty transitively enabled
INFO : resources transitively enabled
INFO : threadpool transitively enabled, ini template available with --add-modules=threadpool
INFO : logging/slf4j dynamic dependency of logging-jetty
INFO : bytebufferpool transitively enabled, ini template available with --add-modules=bytebufferpool
INFO : Base directory was modified
2024-09-11 19:45:42 [io.dongtai.iast.agent] [INFO] Uninstall engine
2024-09-11 19:45:43 [io.dongtai.iast.agent] [INFO] Engine uninstallation succeeded
执行了这个，发现agent是在线的，过一会agent全部离线
Additional Information
1
Logs
[root@localhost jetty-home-12.0.13]# java -javaagent:/root/DongTai/iast-tool/dongtai-agent.jar -Dproject.name=jetty -jar /root/DongTai/iast-tool/jetty-home-12.0.13/start.jar --add-modules=server --jetty.base=/root/DongTai/iast-tool/jetty-base
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] DongTai Config: /tmp/DemoProject-v1.0.0-43d07341e6b84e9da362204257007aca/iast/iast.properties
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] fluent extract success.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] Agent registered successfully.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-spy was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-core was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-api was successfully written to the local cache.
2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-grpc was successfully written to the local cache.
Java HotSpot(TM) 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Engine is successfully installed to the JVM, and it takes 1 s
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Agent Version: v1.7.5, DongTai Server: http://192.168.201.190/openapi
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] Turn on the engine
2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai engine start successfully.
WARN : creating start.d in ${jetty.home} is not recommended!
Proceed (y/N)? y
INFO : mkdir ${jetty.base}/start.d
INFO : server initialized in ${jetty.base}/start.d/server.ini
INFO : logging-jetty transitively enabled
INFO : resources transitively enabled
INFO : threadpool transitively enabled, ini template available with --add-modules=threadpool
INFO : logging/slf4j dynamic dependency of logging-jetty
INFO : bytebufferpool transitively enabled, ini template available with --add-modules=bytebufferpool
INFO : Base directory was modified
2024-09-11 19:45:42 [io.dongtai.iast.agent] [INFO] Uninstall engine
2024-09-11 19:45:43 [io.dongtai.iast.agent] [INFO] Engine uninstallation succeeded
Preflight Checklist
Version
1.8.3
Installation Type
Official Docker Compose
Service Name
DongTai-agent-java
Describe the details of the bug and the steps to reproduce it
[root@localhost jetty-home-12.0.13]# java -javaagent:/root/DongTai/iast-tool/dongtai-agent.jar -Dproject.name=jetty -jar /root/DongTai/iast-tool/jetty-home-12.0.13/start.jar --add-modules=server --jetty.base=/root/DongTai/iast-tool/jetty-base 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] DongTai Config: /tmp/DemoProject-v1.0.0-43d07341e6b84e9da362204257007aca/iast/iast.properties 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] fluent extract success. 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] Agent registered successfully. 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-spy was successfully written to the local cache. 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-core was successfully written to the local cache. 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-api was successfully written to the local cache. 2024-09-11 19:45:28 [io.dongtai.iast.agent] [INFO] The remote file http://192.168.201.190/openapi/api/v1/engine/download?engineName=dongtai-grpc was successfully written to the local cache. Java HotSpot(TM) 64-Bit Server VM warning: Sharing is only supported for boot loader classes because bootstrap classpath has been appended 2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Engine is successfully installed to the JVM, and it takes 1 s 2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai Agent Version: v1.7.5, DongTai Server: http://192.168.201.190/openapi 2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] Turn on the engine 2024-09-11 19:45:30 [io.dongtai.iast.agent] [INFO] DongTai engine start successfully. WARN : creating start.d in ${jetty.home} is not recommended!
Proceed (y/N)? y INFO : mkdir ${jetty.base}/start.d INFO : server initialized in ${jetty.base}/start.d/server.ini INFO : logging-jetty transitively enabled INFO : resources transitively enabled INFO : threadpool transitively enabled, ini template available with --add-modules=threadpool INFO : logging/slf4j dynamic dependency of logging-jetty INFO : bytebufferpool transitively enabled, ini template available with --add-modules=bytebufferpool INFO : Base directory was modified 2024-09-11 19:45:42 [io.dongtai.iast.agent] [INFO] Uninstall engine 2024-09-11 19:45:43 [io.dongtai.iast.agent] [INFO] Engine uninstallation succeeded
执行了这个，发现agent是在线的，过一会agent全部离线
Additional Information
1
Logs