Skip to content
HackIndex logo

HackIndex

Nmap AJP URI Requests with ajp-request

2 min read Feb 7, 2026

The ajp-request NSE script sends arbitrary HTTP requests over the AJP connector and returns the response body. Use it to retrieve application content from paths that may not be accessible via the front-end HTTP proxy, confirm whether the Tomcat manager is deployed, and validate whether risky methods discovered in ajp-methods actually return meaningful responses. Run AJP fingerprinting first to get the context path from the JSESSIONID cookie before probing paths here.

Request Root and Common Tomcat Paths

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/' 
| ajp-request:
| HTTP/1.1 200 OK
| ...
|_<title>Apache Tomcat/9.0.31</title>
┌──(kali㉿kali)-[~]
└─$ for path in / /manager/html /host-manager/html /docs/ /examples/ /webapp/; do
echo "=== $path ==="
nmap -p 8009 $TARGET_IP --script ajp-request --script-args "ajp-request.path=$path" 2>/dev/null | grep -iE 'title|status|auth|manager|error'
done 
=== / ===
<title>Apache Tomcat/9.0.31</title>
=== /manager/html ===
401 Unauthorized
WWW-Authenticate: Basic realm="Tomcat Manager Application"

A 401 on /manager/html confirms the manager is deployed and requires credentials. The Tomcat version in the title is an immediate CVE lookup target. Move to Tomcat manager testing for credential attacks.

Test Risky Methods

Validate methods flagged by ajp-methods against the actual application paths:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.method=OPTIONS' 
| ajp-request:
| HTTP/1.1 200 OK
|_Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS
┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.method=TRACE'

Authenticated Request to Manager

Once credentials are found from other sources, test them directly against the manager via AJP:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args "ajp-request.path=/manager/html,ajp-request.username=$USER,ajp-request.password=$PASSWORD" 
| ajp-request:
| HTTP/1.1 200 OK
|_<title>Tomcat Web Application Manager</title>

Save Response Bodies for Analysis

Capture large responses to disk for offline grepping when the inline nmap output is truncated:

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.filename=/tmp/ajp_root.html' && cat /tmp/ajp_root.html | grep -iE 'version|link|href|form|action'

References