# Nmap AJP Fingerprinting

- **URL:** https://hackindex.io/services/tomcat-ajp/enumeration/nmap-ajp-fingerprinting
- **Path:** Tomcat / AJP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/tomcat-ajp/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-02-07

## AJP Nmap Fingerprinting

AJP (Apache JServ Protocol) on port 8009 is the connector between a front-end web server and Tomcat. When exposed directly, it provides an alternate entry point into the Java application stack that may bypass front-end access controls. Fingerprinting confirms the connector is active, reveals the application context paths, and identifies which HTTP methods are accepted. Move to [AJP URI requests](https://hackindex.io/services/tomcat-ajp/enumeration/nmap-ajp-uri-requests-with-ajp-request) after establishing the context, and to [Ghostcat file read testing](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/ghostcat-ajp-file-read) for CVE-2020-1938.

- Confirm AJP Service
- Pull Response Headers via AJP
- Enumerate Supported HTTP Methods
- When Scripts Return Nothing

## Confirm AJP Service

```bash
nmap -sV -p 8009 $TARGET_IP
# 8009/tcp open  ajp13   Apache Jserv (Protocol v1.3)
```

## Pull Response Headers via AJP

The JSESSIONID cookie path reveals the deployed web application context: this is the path to probe next:

```bash
nmap -p 8009 $TARGET_IP --script ajp-headers --script-args 'ajp-headers.path=/'
# | ajp-headers:
# |   X-Powered-By: JSP/2.2
# |   Set-Cookie: JSESSIONID=abc123; Path=/webapp
# |   Content-Type: text/html;charset=UTF-8
# |_  Content-Length: 842
```

`Path=/webapp` in the JSESSIONID cookie confirms the deployed application context is `/webapp`. Probe that path directly with [ajp-request](https://hackindex.io/services/tomcat-ajp/enumeration/nmap-ajp-uri-requests-with-ajp-request) and also test it over HTTP/HTTPS if those ports exist. A `Path=/manager` is an immediate priority: it means the Tomcat manager is deployed and accessible via AJP.

```bash
nmap -p 8009 $TARGET_IP --script ajp-headers --script-args 'ajp-headers.path=/manager/html'
# | ajp-headers:
# |   WWW-Authenticate: Basic realm="Tomcat Manager Application"
# |_  Content-Type: text/html;charset=utf-8
```

## Enumerate Supported HTTP Methods

```bash
nmap -p 8009 $TARGET_IP --script ajp-methods --script-args 'ajp-methods.path=/'
# | ajp-methods:
# |   Supported methods: GET HEAD POST PUT DELETE TRACE OPTIONS
# |   Potentially risky methods: PUT DELETE TRACE
# |_  See https://nmap.org/nsedoc/scripts/ajp-methods.html
```

PUT and DELETE being enabled is a finding: it should not be accepted on standard Tomcat deployments. TRACE enables cross-site tracing. Test PUT against specific application paths to confirm whether file upload via AJP is possible. Check methods on the manager context separately:

```bash
nmap -p 8009 $TARGET_IP --script ajp-methods --script-args 'ajp-methods.path=/manager/html'
```

## When Scripts Return Nothing

If ajp-headers and ajp-methods return nothing despite the port being open, the connector may expect specific attributes or be bound to a particular virtual host. Try verbose mode and direct AJP requests:

```bash
nmap -p 8009 $TARGET_IP --script ajp-headers,ajp-methods -d 2>&1 | grep -iE 'AJP|error|failed|open'
```

## References

- [nmap: ajp-headers NSE](https://nmap.org/nsedoc/scripts/ajp-headers.html) - Script args and JSESSIONID context path output
- [nmap: ajp-methods NSE](https://nmap.org/nsedoc/scripts/ajp-methods.html) - Supported methods discovery and risky method identification