Tomcat

Directory map

• Tomcat — Discovery & Enumeration — fingerprinting, /docs, /manager, directory structure, default credentials, enumeration techniques
• Attacking Tomcat — credential brute force, WAR upload RCE, web shell hygiene, CVE-2020-1938 Ghostcat (AJP LFI)

Summary

Apache Tomcat is an open-source web server for hosting Java-based applications. With over 220,000 live Tomcat websites and significant adoption (3.8% of top 100k sites), it’s a common target on internal networks.

Key characteristics:

• Port: Default 8080 (often exposed internally)
• Version detection: HTTP headers reveal version; /docs page available by default
• Manager access: /manager and /host-manager require credentials stored in tomcat-users.xml
• Default credentials: Often weak or unchanged (tomcat:tomcat, admin:admin)
• Deployment: WAR (Web Application Archive) files can be uploaded via Manager for RCE
• High-value target: Often #1 on internal pentesting assessments due to weak configurations

Common vulnerabilities:

• Weak/default credentials on Manager interface
• Outdated versions with known CVEs
• Exposed configuration files revealing application structure
• Unrestricted file upload via Manager (with valid credentials)

Directory structure: Tomcat stores configuration in /conf, applications in /webapps, and manages deployments through the Manager application. The tomcat-users.xml file is critical, containing admin credentials and role definitions.