Tomcat — Discovery & Enumeration

Apache Tomcat is an open-source web server for hosting Java-based applications. It runs Java Servlets, JSP scripts, and is widely used by frameworks like Spring and tools like Gradle. Tomcat is often exposed on internal networks and is a common target during internal penetration tests.

Statistics & Prevalence

• 220,000+ live Tomcat websites (BuiltWith data)
• 904,000+ websites have used Tomcat at some point
• 1.22% of top 1 million websites use Tomcat
• 3.8% of top 100k websites use Tomcat
• Market share rank: #13 for web servers

Notable users: Alibaba, USPTO, American Red Cross, LA Times

Tomcat Directory Structure

Understanding the Tomcat installation structure is crucial for exploitation and enumeration.

tomcat_home/
├── bin/                      # Startup/shutdown scripts and binaries
├── conf/                     # Configuration files
│   ├── catalina.policy       # Security policy file
│   ├── catalina.properties   # Tomcat properties
│   ├── context.xml           # Default context configuration
│   ├── tomcat-users.xml      # User credentials and roles
│   ├── tomcat-users.xsd      # XML schema for tomcat-users
│   └── web.xml               # Global web application configuration
├── lib/                      # JAR files for Tomcat core functionality
├── logs/                     # Log files
├── temp/                     # Temporary files
├── webapps/                  # Default web root (application deployment)
│   ├── manager/              # Tomcat manager application
│   │   ├── images/
│   │   ├── META-INF/
│   │   └── WEB-INF/
│   └── ROOT/                 # Default application
│       └── WEB-INF/
└── work/                     # Cache and runtime data
    └── Catalina/
        └── localhost/

Key Configuration Files

tomcat-users.xml: Stores user credentials and role assignments for manager/host-manager access.

<?xml version="1.0" encoding="UTF-8"?>
<tomcat-users xmlns="http://tomcat.apache.org/xml"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
              version="1.0">

  <!-- Built-in Tomcat manager roles: -->
  <!-- manager-gui    - HTML GUI and status pages -->
  <!-- manager-script - HTTP API and status pages -->
  <!-- manager-jmx    - JMX proxy and status pages -->
  <!-- manager-status - Status pages only -->

  <role rolename="manager-gui" />
  <user username="tomcat" password="tomcat" roles="manager-gui" />

  <role rolename="admin-gui" />
  <user username="admin" password="admin" roles="manager-gui,admin-gui" />

</tomcat-users>

Application Structure

Each application deployed in webapps/ follows this structure:

webapps/customapp/
├── images/
├── index.jsp
├── META-INF/
│   └── context.xml
├── status.xsd
└── WEB-INF/
    ├── jsp/
    │   └── admin.jsp
    ├── web.xml                # Deployment descriptor (IMPORTANT)
    ├── lib/
    │   └── jdbc_drivers.jar   # Application libraries
    └── classes/
        └── AdminServlet.class # Compiled servlets

WEB-INF/web.xml (Deployment Descriptor)

The web.xml file defines servlets, servlet mappings, and other application configuration. This is critical for understanding application structure and finding potential entry points.

Example:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" 
  "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
  <servlet>
    <servlet-name>AdminServlet</servlet-name>
    <servlet-class>com.inlanefreight.api.AdminServlet</servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>AdminServlet</servlet-name>
    <url-pattern>/admin</url-pattern>
  </servlet-mapping>
</web-app>

This configuration:

• Defines a servlet AdminServlet mapped to class com.inlanefreight.api.AdminServlet
• Maps requests to /admin to this servlet
• Shows the class would be located at: classes/com/inlanefreight/api/AdminServlet.class

Important: The web.xml file reveals application routes and handler classes, making it valuable during LFI exploitation.

Fingerprinting & Discovery

HTTP Header Detection

Tomcat versions are often revealed in the Server header. Requesting an invalid page typically exposes the server version:

curl -i http://target.com:8080/invalid

Response (Tomcat 9.0.30):

HTTP/1.1 404 Not Found
Server: Apache Tomcat/9.0.30
...

/docs Page

If custom error pages aren’t configured, the /docs endpoint provides version information:

curl -s http://target.com:8080/docs/ | grep -i tomcat

Output:

<title>Apache Tomcat 9 (9.0.30) - Documentation Index</title>

The /docs page is a default documentation page often left in place by administrators.

Enumeration

Directory Brute-Force

Use tools like Gobuster to enumerate common Tomcat directories:

gobuster dir -u http://target.com:8180/ \
  -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt

Common Tomcat paths to find:

• /docs — Documentation (version leak)
• /examples — Example applications
• /manager — Tomcat Manager (admin interface)
• /host-manager — Host Manager (advanced admin)
• /admin — Older admin console

Example Gobuster Output:

/docs (Status: 302)
/examples (Status: 302)
/manager (Status: 302)
/host-manager (Status: 302)

Manager & Host-Manager Pages

The /manager page is the primary target. It typically requires Basic Authentication with credentials stored in tomcat-users.xml.

Common default credentials to try:

• tomcat:tomcat
• admin:admin
• admin:password
• tomcat:password
• manager:manager

Direct access attempt:

curl -u tomcat:tomcat http://target.com:8080/manager/html

If credentials are weak or default, you can:

1. Log into the Manager GUI
2. Upload a WAR (Web Application Resource) file containing a JSP web shell
3. Gain remote code execution on the server

Key Findings During Enumeration

Best Practices for Enumeration

1. Always check /docs — Easy version identification
2. Test default credentials — Very common in internal environments
3. Enumerate all paths — Manager, host-manager, and custom applications
4. Check for accessible configuration files — Via directory listing or LFI
5. Document all findings — Note versions, paths, and potential entry points

Next Steps

Once enumeration is complete:

• If credentials are found/guessed → exploit Manager via WAR upload
• If known vulnerability exists → test for CVE
• If LFI found → attempt to read tomcat-users.xml or web.xml
• If nothing else works → perform credential brute-force against Manager login