Skip to content
HackIndex.io
Tomcat / AJP
Service

Tomcat / AJP

Apache Tomcat web server using AJP connector. Attackers fingerprint versions, exploit Ghostcat for file read, discover exposed Manager panels, and deploy malicious WAR files for RCE

:8009 6 guides 3 phases
2 min read Created: Jan 26, 2026 Updated: Jul 14, 2026

Apache Tomcat is a widely used Java servlet container. The AJP (Apache JServ Protocol) connector runs on TCP port 8009 and provides a binary protocol for communication between a front-end web server and Tomcat. The HTTP management interface typically runs on TCP port 8080. Nmap identifies AJP as ajp13.

AJP was designed for trusted internal communication and should never be exposed to untrusted networks. The Ghostcat vulnerability (CVE-2020-1938) demonstrated that an exposed AJP port allows an attacker to read arbitrary files from the web application, including configuration files with database credentials and application secrets. Combined with a file upload, Ghostcat enables remote code execution. The Tomcat Manager interface on port 8080 is another common target, with default credentials (tomcat:tomcat, admin:admin) frequently found.

Enumeration involves scanning for AJP on port 8009 and testing with tools like AJPy or the Ghostcat exploit to read files such as WEB-INF/web.xml. The HTTP manager interface should be checked for default or weak credentials that allow WAR file deployment for code execution. Nmap's ajp-methods and ajp-request scripts provide initial reconnaissance.

Enumeration

Nmap guides for AJP fingerprinting and URI enumeration on Tomcat

3

Tomcat HTTP Enumeration

Enumerate Apache Tomcat & AJP services; identify versions, exposed management interfaces, default credentials, and misconfigurations using active scanning techniques.

Mar 30, 2026 • 3 min read

Vulnerability Discovery

Ghostcat file read via AJP and exposed Manager discovery

2

Tomcat Manager Exposed

Identify exposed Tomcat Manager interfaces, enumerate credentials via default/brute-force attacks, and leverage access for WAR-based RCE deployment.

Mar 30, 2026 • 3 min read

Exploitation

Guides on deploying malicious WAR files via Tomcat Manager

1

Tomcat Manager WAR Deployment

Deploy malicious WAR files via Tomcat Manager to gain remote code execution, exploiting weak credentials or misconfigurations in exposed management interfaces.

Mar 30, 2026 • 5 min read