Skip to content
HackIndex logo

HackIndex

Nmap AJP Fingerprinting

2 min read Feb 7, 2026

AJP (Apache JServ Protocol) on port 8009 is the connector between a front-end web server and Tomcat. When exposed directly, it provides an alternate entry point into the Java application stack that may bypass front-end access controls. Fingerprinting confirms the connector is active, reveals the application context paths, and identifies which HTTP methods are accepted. Move to AJP URI requests after establishing the context, and to Ghostcat file read testing for CVE-2020-1938.

Confirm AJP Service

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 8009 $TARGET_IP 
8009/tcp open  ajp13   Apache Jserv (Protocol v1.3)

Pull Response Headers via AJP

The JSESSIONID cookie path reveals the deployed web application context — this is the path to probe next:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-headers --script-args 'ajp-headers.path=/' 
| ajp-headers:
|   X-Powered-By: JSP/2.2
|   Set-Cookie: JSESSIONID=abc123; Path=/webapp
|   Content-Type: text/html;charset=UTF-8
|_  Content-Length: 842

Path=/webapp in the JSESSIONID cookie confirms the deployed application context is /webapp. Probe that path directly with ajp-request and also test it over HTTP/HTTPS if those ports exist. A Path=/manager is an immediate priority — it means the Tomcat manager is deployed and accessible via AJP.

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-headers --script-args 'ajp-headers.path=/manager/html' 
| ajp-headers:
|   WWW-Authenticate: Basic realm="Tomcat Manager Application"
|_  Content-Type: text/html;charset=utf-8

Enumerate Supported HTTP Methods

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-methods --script-args 'ajp-methods.path=/' 
| ajp-methods:
|   Supported methods: GET HEAD POST PUT DELETE TRACE OPTIONS
|   Potentially risky methods: PUT DELETE TRACE
|_  See https://nmap.org/nsedoc/scripts/ajp-methods.html

PUT and DELETE being enabled is a finding — it should not be accepted on standard Tomcat deployments. TRACE enables cross-site tracing. Test PUT against specific application paths to confirm whether file upload via AJP is possible. Check methods on the manager context separately:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-methods --script-args 'ajp-methods.path=/manager/html'

When Scripts Return Nothing

If ajp-headers and ajp-methods return nothing despite the port being open, the connector may expect specific attributes or be bound to a particular virtual host. Try verbose mode and direct AJP requests:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-headers,ajp-methods -d 2>&1 | grep -iE 'AJP|error|failed|open'

References