UNABLE TO DETECT ATTACKS

[SAJAL GUPTA]

I have been trying to setup openrasp java agent along with my Java application running on localhost on Jetty server. I have followed the following steps using the openrasp documentation:

1. Download latest version of OpenRASP java agent from https://github.com/baidu/openrasp/releases
   I used the following link: (https://github.com/baidu/openrasp/releases/download/v1.3.7/rasp-java.tar.gz)
   
   
2. Extracted the jar (for Jetty/Java servers) as per https://github.com/baidu/openrasp/wiki/Installation
   
   
3. Setup the configurations in the ‘xxx/openrasp/rasp/conf/openrasp.yml’ file as per https://github.com/baidu/openrasp/wiki/Configurations
   
   
4. Follow two subsections mentioned below of ‘Detection Plugin’ section as per https://rasp.baidu.com/doc/setup/standalone.html:
   1. ‘Turn on blocking’
   2. ‘Enable behavior log’
      
      
5. cd into the application directory and run the following command to start the application along with the openrasp agent:

MAVEN_OPTS='-javaagent:/srv/openrasp/rasp/rasp.jar -Dopenrasp.conf.path=/srv/openrasp/rasp/conf/openrasp.yml' mvn jetty:run

The openrasp is running successfully (that is, without any errors in the terminal). However, I am still not able to see either any logs or any interception page while using attack test cases on the application.

Can anyone please let me know if I am missing something or doing anything incorrect?

Thanks,

SAJAL