Skip to content
HackIndex logo

HackIndex

Tomcat HTTP Enumeration

2 min read Mar 30, 2026

Tomcat typically runs HTTP on port 8080 and HTTPS on 8443 alongside the AJP connector on 8009. HTTP enumeration extracts the exact Tomcat version from error pages and headers, identifies whether the manager application is deployed, and maps deployed web application contexts. The version is the critical signal — it determines which CVEs apply and whether Ghostcat (CVE-2020-1938) is exploitable via the AJP connector.

Service Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 8080,8443,8009 $TARGET_IP 
8009/tcp open  ajp13   Apache Jserv (Protocol v1.3)
8080/tcp open  http    Apache Tomcat 9.0.31
8443/tcp open  ssl/http Apache Tomcat 9.0.31

Version Extraction via Error Page

Tomcat's default error page discloses the exact version. A non-existent path triggers a 404 that contains it:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8080/doesnotexist | grep -iE 'Apache Tomcat|version' 
<h3>Apache Tomcat/9.0.31</h3>
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:8080/ | grep -iE 'server|x-powered-by' 
Server: Apache-Coyote/1.1

Cross-reference the version against Ghostcat affected versions immediately. Tomcat 9.0.31 and below, 8.5.51 and below, and 7.0.100 and below are all vulnerable to CVE-2020-1938.

Manager and Host Manager Discovery

┌──(kali㉿kali)-[~]
└─$ for path in /manager/html /manager/status /manager/text /host-manager/html /admin; do
code=$(curl -skI http://$TARGET_IP:8080$path | grep HTTP | awk '{print $2}')
echo "$code $path"
done 
401 /manager/html
401 /manager/status
401 /manager/text
401 /host-manager/html
404 /admin

401 on manager paths confirms the manager is deployed and requires authentication. Move to Tomcat manager testing to attempt default credentials.

Default Application Discovery

Tomcat ships with default applications that should be removed in production:

┌──(kali㉿kali)-[~]
└─$ for path in /docs /examples /examples/jsp /examples/servlets /ROOT; do
code=$(curl -skI http://$TARGET_IP:8080$path/ | grep HTTP | awk '{print $2}')
echo "$code $path/"
done 
200 /docs/
200 /examples/
200 /examples/jsp/
404 /ROOT/

/examples present in production is a finding — the JSP examples include interactive forms that can be used for reconnaissance and the servlet examples sometimes expose request processing internals.

Deployed Web Application Enumeration

Enumerate deployed applications via the manager status endpoint without needing manager credentials:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8080/manager/status --user admin:admin | grep -iE 'context|path|sessions'
┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP:8080/ -w /usr/share/seclists/Discovery/Web-Content/tomcat.txt --random-agent
Explain command
dir Use directory/file brute-forcing mode.
-u Target URL to enumerate.
http://$TARGET_IP:8080/ Target base URL with host IP and port 8080.
-w Specify the wordlist file path to use.
/usr/share/seclists/Discovery/Web-Content/tomcat.txt Wordlist tailored for Apache Tomcat path discovery.
--random-agent Send a random User-Agent header with each request.

References