Skip to content
HackIndex.io

Nmap AJP URI Requests with ajp-request

5 min read Created Feb 7, 2026 Last updated Feb 7, 2026

The ajp-request NSE script sends arbitrary HTTP requests over the AJP connector and returns the response body. AJP operates on port 8009 and bypasses the HTTP reverse proxy entirely. Requests hit Tomcat directly, so proxy-level access controls and WAF rules do not apply. This often exposes paths that return 403 or 404 over HTTP but serve content over AJP without restriction. Use this script to retrieve content from paths blocked at the proxy and confirm whether the Tomcat manager is deployed. It also validates risky HTTP methods flagged by ajp-methods. The script supports custom HTTP methods, Basic authentication credentials, and response body output to a local file. Run AJP fingerprinting first to get the context path from the JSESSIONID cookie before probing specific paths here.

  • Request Root and Common Tomcat Paths
  • Test Risky Methods
  • Authenticated Request to Manager
  • Save Response Bodies for Analysis

Request Root and Common Tomcat Paths

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/' 
| ajp-request:
| HTTP/1.1 200 OK
| ...
|_<title>Apache Tomcat/9.0.31</title>
┌──(kali㉿kali)-[~]
└─$ for path in / /manager/html /host-manager/html /docs/ /examples/ /webapp/; do
echo "=== $path ==="
nmap -p 8009 $TARGET_IP --script ajp-request --script-args "ajp-request.path=$path" 2>/dev/null | grep -iE 'title|status|auth|manager|error'
done 
=== / ===
<title>Apache Tomcat/9.0.31</title>
=== /manager/html ===
401 Unauthorized
WWW-Authenticate: Basic realm="Tomcat Manager Application"

A 200 on the root path confirms the AJP connector accepts requests and the application is running. A 401 on /manager/html confirms the manager is deployed and guarded by HTTP Basic authentication. Note the realm name in the WWW-Authenticate header. It sometimes identifies the application or server brand. The Tomcat version in the page title is an immediate CVE lookup target. Cross-check it against CVE-2020-1938 (Ghostcat), which allows unauthenticated file inclusion directly over AJP and affected most Tomcat releases before early 2020. Check /host-manager/html separately, as it is sometimes deployed with different credentials or looser access controls. A 404 on /manager/html does not rule out a manager deployed at a non-default context path. Probe /manager/text and /manager/jmxproxy as alternative manager endpoints. Move to Tomcat manager testing for credential attacks once the deployment is confirmed.

Test Risky Methods

Validate methods flagged by ajp-methods against the actual application paths. An OPTIONS response listing PUT or DELETE indicates the application may accept file write or delete operations on that path. TRACE being enabled allows HTTP header reflection, which assists in cross-site tracing attacks. Test each dangerous method against application-specific paths, not just root. A method allowed on / may be blocked on /manager/html by a separate security constraint. If PUT is enabled on a path that accepts uploads, pursue writing a JSP shell in the exploitation phase. A 405 Method Not Allowed response still confirms the path exists. A 403 typically means access is restricted by a security constraint, not the method policy.

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.method=OPTIONS' 
| ajp-request:
| HTTP/1.1 200 OK
|_Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS
┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.method=TRACE'

Authenticated Request to Manager

Once credentials are found from other sources, test them directly against the manager via AJP. A 200 response with the Tomcat Web Application Manager title confirms the credentials are valid and the manager is accessible. Check whether the response headers set a session cookie. From the manager you can list deployed applications, deploy a malicious WAR file, and reach remote code execution. Save the full response body to disk and grep for deployed application names and context paths. Some applications are not linked from the default manager navigation. A 403 here despite a 200 on the root path indicates the account lacks the manager-gui or manager-script role. Try /manager/text as a fallback. It accepts the same credentials and returns plain-text responses that are easier to parse with grep.

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args "ajp-request.path=/manager/html,ajp-request.username=$USER,ajp-request.password=$PASSWORD" 
| ajp-request:
| HTTP/1.1 200 OK
|_<title>Tomcat Web Application Manager</title>

Save Response Bodies for Analysis

Nmap truncates long script output in the terminal, so response bodies longer than a few kilobytes will be cut. Writing to a file preserves the complete response for offline analysis. Grep the saved file for version strings, hidden form actions, link targets, and HTML comment blocks. Server-side error pages often contain stack traces that expose internal class names, file paths, and framework versions. Application landing pages sometimes reference admin interfaces or configuration endpoints not linked from the main navigation. Cross-reference discovered paths with the ajp-methods output to check which HTTP methods are accepted at each one. If the response body contains a login form, extract the action attribute to identify the authentication endpoint before moving to credential attacks.

┌──(kali㉿kali)-[~]
└─$ nmap -p 8009 $TARGET_IP --script ajp-request --script-args 'ajp-request.path=/,ajp-request.filename=/tmp/ajp_root.html' && cat /tmp/ajp_root.html | grep -iE 'version|link|href|form|action'

References