DOCSEARCHbyAlgolia
Submit Docs

Apache JMeter Documentation

repository·master·Indexed 27 days ago

https://github.com/apache/jmeter

Apache JMeter is an open-source Java application designed to measure performance and load test a wide variety of applications and protocols, including HTTP, HTTPS, SOAP/REST, FTP, JDBC, LDAP, JMS, Mail, TCP, and Java Objects. It features a GUI for building and debugging test plans, a headless command-line mode for execution, and capabilities for dynamic HTML reporting and data correlation using various extractors.

Tokens
19.1K
Snippets
40
Records
135
Agent score
92%

What's inside Apache JMeter

  1. Overview of Apache JMeter Features

    master

    Apache JMeter is an open-source Java application for performance and load testing.

    Key Capabilities

    • Protocols Supported: HTTP, HTTPS, SOAP/REST, FTP, JDBC (Databases), LDAP, JMS (MOM), Mail (SMTP/POP3/IMAP), TCP, and Java Objects.
    • Test IDE: A GUI for recording, building, and debugging test plans.
    • Command Line: Headless mode for execution on any Java-compatible OS.
    • Reporting: Generates dynamic HTML dashboards and supports live reporting to 3rd party databases like InfluxDB or Graphite.
    • Correlation: Extract data from HTML, JSON, XML, or any textual format using extractors (e.g., CSS/JQuery, JSON, XPath, Regular Expression Extractors).
    • Extensibility: Supports pluggable Samplers, scriptable Samplers (Groovy via JSR223), and custom visualization plugins.

  2. Understand the Apache JMeter Security Model and Scope

    master

    Apache JMeter is designed as a user-run tool where the operator is the trusted party. The tool's primary purpose is to execute the workload specified in a .jmx file, which may include arbitrary code (via JSR223/Groovy/BeanShell).

    Key Security Principles:

    • Trusted Operator: The user is responsible for the .jmx files they run. Running a plan that contains arbitrary code is the intended behavior, not a vulnerability.
    • Isolation Responsibility: If you need to evaluate untrusted .jmx files, you must provide your own isolation environment.
    • Out of Scope: JMeter does not claim to protect the System Under Test (SUT) from being attacked, nor does it claim to be hardened against a hostile SUT (e.g., a malicious server sending crafted responses to exploit JMeter's parsers like XXE or ReDoS).
    • Unauthorized Use: Using JMeter to test systems without authorization is a legal/ethical violation and is not considered a JMeter vulnerability.

  3. Identify required API specification libraries for compilation

    master
    The lib/api directory contains binary archives for software that is not bundled with the standard JMeter binary release but is required for compiling JMeter code. Currently, this directory provides the binary JARs for the Legion of the Bouncy Castle Java cryptography APIs.

  4. Configure secure distributed testing (RMI)

    master

    When setting up distributed testing, maintain the secure defaults to ensure mutual-TLS protection. Avoid the common anti-pattern of disabling SSL to simplify setup.

    Security Requirements:

    • Keep server.rmi.ssl.disable=false (the default).
    • Generate a unique RMI keystore using the provided script: create-rmi-keystore.sh (or .bat on Windows).
    • Restrict the bind interface using java.rmi.server.hostname.
    • Use a firewall to restrict access to server.rmi.port and server.rmi.localport.
    • Warning: Do not set server.rmi.ssl.disable=true if the engine is reachable from an untrusted network.

  8. System Isolation for JDK 24+ Environments

    master

    As the Java Security Manager is being removed in newer JDK versions (JDK 24+), JMeter users should move toward OS-level isolation for defense-in-depth.

    Recommended Isolation Methods:

    • Use containers (e.g., Docker).
    • Use systemd hardening.
    • Run JMeter under a dedicated, restricted OS user.

  9. Secure HTTPS recording with the Proxy

    master

    When using the JMeter recording proxy, follow these steps to prevent Man-in-the-Middle (MITM) exposure:

    1. Limit Certificate Validity: Do not set proxy.cert.validity to a long duration; keep it only as long as the recording session requires.
    2. Cleanup: Once your recording session is complete, remove the JMeter CA certificate from your operating system and browser trust stores.

  10. Launch Apache JMeter from Eclipse with Debugging

    master

    To run Apache JMeter from Eclipse with the ability to use the debugger, you must create a custom Java Application launch configuration. Using the Gradle runGui task is an alternative for starting the GUI, but it does not support Eclipse debugging.

    Prerequisites: Ensure Eclipse is configured to use the classpath as specified in the project's contribution guidelines.

    Steps to create the Launch Configuration:

    1. Create a new Java Application launch configuration.
    2. Set the Project to dist.
    3. Set the main class to org.apache.jmeter.NewDriver.
    4. In the Arguments tab, set the Working Directory to: ${workspace_loc:jmeter/bin}.

  12. Securely handle untrusted .jmx files

    master

    JMeter does not sandbox the test plans it runs. Running a .jmx file executes its contained code and scripts. Do not open or run .jmx files from untrusted sources without isolation.

    To safely evaluate an untrusted test plan, use one of the following isolation methods:

    1. Containerization (Recommended): Use docker or podman with a non-root user, a --read-only root filesystem, --tmpfs /tmp, and --cap-drop=ALL. Ensure the network is scoped only to the controller.
    2. Systemd Hardening: Use directives such as NoNewPrivileges=true, PrivateTmp=true, and ProtectSystem=strict.
    3. Dedicated OS User: Run JMeter under a dedicated, least-privilege OS user.