# Tomcat / AJP

> Apache Tomcat web server using AJP connector. Attackers fingerprint versions, exploit Ghostcat for file read, discover exposed Manager panels, and deploy malicious WAR files for RCE

- **URL:** https://hackindex.io/services/tomcat-ajp
- **Type:** Service
- **Default ports:** 8009
- **Tags:** web, tomcat, ajp, java, apache, connector
- **Published:** 2026-01-26
- **Updated:** 2026-07-14

Apache Tomcat is a widely used Java servlet container. The AJP (Apache JServ Protocol) connector runs on **TCP port 8009** and provides a binary protocol for communication between a front-end web server and Tomcat. The HTTP management interface typically runs on **TCP port 8080**. Nmap identifies AJP as `ajp13`.

AJP was designed for trusted internal communication and should never be exposed to untrusted networks. The Ghostcat vulnerability (CVE-2020-1938) demonstrated that an exposed AJP port allows an attacker to read arbitrary files from the web application, including configuration files with database credentials and application secrets. Combined with a file upload, Ghostcat enables remote code execution. The Tomcat Manager interface on port 8080 is another common target, with default credentials (`tomcat:tomcat`, `admin:admin`) frequently found.

Enumeration involves scanning for AJP on port 8009 and testing with tools like `AJPy` or the Ghostcat exploit to read files such as `WEB-INF/web.xml`. The HTTP manager interface should be checked for default or weak credentials that allow WAR file deployment for code execution. Nmap's `ajp-methods` and `ajp-request` scripts provide initial reconnaissance.

## Phases

- [Enumeration](https://hackindex.io/services/tomcat-ajp/enumeration.md): Nmap guides for AJP fingerprinting and URI enumeration on Tomcat (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery.md): Ghostcat file read via AJP and exposed Manager discovery (2 guides)
- [Exploitation](https://hackindex.io/services/tomcat-ajp/exploitation.md): Guides on deploying malicious WAR files via Tomcat Manager (1 guides)