DongTai-agent-java

DongTai-agent-java is the data acquisition tool for DongTai IAST that collects method invocation data during runtime of Java applications through dynamic hooks, enabling security vulnerability detection and analysis.

One Minute Overview#

DongTai-agent-java is the data acquisition tool for DongTAI Interactive Application Security Testing (IAST) that collects security-related data during runtime of Java applications through bytecode instrumentation. It's designed for developers and security testers to detect vulnerabilities before applications go live, helping discover potential security issues.

Core Value: Provides zero false positives application security detection capability without requiring code modifications to discover security vulnerabilities.

Quick Start#

Installation Difficulty: Moderate - Requires Java development environment and configuration of Java Agent parameters

# Run the application with DongTai Agent attached
java -javaagent:/path/to/dongtai-agent.jar -Ddongtai.debug=true -jar app.jar

Is this suitable for my scenario?

✅ DevSecOps Integration: Can be integrated into CI/CD pipelines for automated security testing

✅ Pre-deployment Security Testing: Comprehensive security assessment before application deployment

✅ Third-party Component Management: Detects known vulnerabilities in open-source components

❌ Small/Simple Applications: May be overly complex for simple personal projects

❌ Performance-sensitive Environments: Bytecode injection may introduce slight performance overhead

Core Capabilities#

1. Dynamic Bytecode Instrumentation - Monitoring without code modification#

Injects bytecode modifications at Java application startup to intercept and collect method invocation data during runtime User Benefit: Obtain application runtime behavior data without code modifications, simplifying the security testing process

2. Comprehensive Middleware Support#

Supports major Java middleware including Tomcat, Jetty, WebLogic, WebSphere, SpringBoot, and more User Benefit: Compatible with enterprise-grade Java application environments, eliminating deployment concerns

3. Real-time Data Collection and Analysis#

Collects requests/responses, method call chains, parameter information, and analyzes security vulnerabilities in real-time User Benefit: Discovers 0-day vulnerabilities and business logic flaws with precise security issue localization

4. Third-party Component Vulnerability Management#

Automatically identifies and analyzes third-party components used in the project to detect known vulnerabilities User Benefit: Promptly fixes security issues in dependencies, mitigating supply chain attack risks