# Tomcat HTTP Enumeration

> Enumerate Apache Tomcat & AJP services; identify versions, exposed management interfaces, default credentials, and misconfigurations using active scanning techniques.

- **URL:** https://hackindex.io/services/tomcat-ajp/enumeration/tomcat-http-enumeration
- **Path:** Tomcat / AJP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/tomcat-ajp/enumeration.md)
- **Published:** 2026-03-30
- **Updated:** 2026-08-11

Tomcat typically runs HTTP on port 8080 and HTTPS on 8443 alongside the AJP connector on 8009. HTTP enumeration extracts the exact Tomcat version from error pages and headers, identifies whether the manager application is deployed, and maps deployed web application contexts. The version is the critical signal: it determines which CVEs apply and whether Ghostcat (CVE-2020-1938) is exploitable via the AJP connector.

- Service Detection
- Version Extraction via Error Page
- Manager and Host Manager Discovery
- Default Application Discovery
- Deployed Web Application Enumeration

## Service Detection

```bash
nmap -sV -p 8080,8443,8009 $TARGET_IP
# 8009/tcp open  ajp13   Apache Jserv (Protocol v1.3)
# 8080/tcp open  http    Apache Tomcat 9.0.31
# 8443/tcp open  ssl/http Apache Tomcat 9.0.31
```

## Version Extraction via Error Page

Tomcat's default error page discloses the exact version. A non-existent path triggers a 404 that contains it:

```bash
curl -sk http://$TARGET_IP:8080/doesnotexist | grep -iE 'Apache Tomcat|version'
# <h3>Apache Tomcat/9.0.31</h3>
```

```bash
curl -skI http://$TARGET_IP:8080/ | grep -iE 'server|x-powered-by'
# Server: Apache-Coyote/1.1
```

Cross-reference the version against [Ghostcat affected versions](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/ghostcat-ajp-file-read) immediately. Tomcat 9.0.30 and below, 8.5.50 and below, and 7.0.99 and below are all vulnerable to CVE-2020-1938.

## Manager and Host Manager Discovery

```bash
for path in /manager/html /manager/status /manager/text /host-manager/html /admin; do
  code=$(curl -skI http://$TARGET_IP:8080$path | grep HTTP | awk '{print $2}')
  echo "$code $path"
done
# 401 /manager/html
# 401 /manager/status
# 401 /manager/text
# 401 /host-manager/html
# 404 /admin
```

401 on manager paths confirms the manager is deployed and requires authentication. Move to [Tomcat manager testing](https://hackindex.io/services/tomcat-ajp/vulnerability-discovery/tomcat-manager-exposed) to attempt default credentials.

## Default Application Discovery

Tomcat ships with default applications that should be removed in production:

```bash
for path in /docs /examples /examples/jsp /examples/servlets /ROOT; do
  code=$(curl -skI http://$TARGET_IP:8080$path/ | grep HTTP | awk '{print $2}')
  echo "$code $path/"
done
# 200 /docs/
# 200 /examples/
# 200 /examples/jsp/
# 404 /ROOT/
```

/examples present in production is a finding: the JSP examples include interactive forms that can be used for reconnaissance and the servlet examples sometimes expose request processing internals.

## Deployed Web Application Enumeration

Enumerate deployed applications via the manager status endpoint without needing manager credentials:

```bash
curl -sk http://$TARGET_IP:8080/manager/status --user admin:admin | grep -iE 'context|path|sessions'
```

```bash
gobuster dir -u http://$TARGET_IP:8080/ -w /usr/share/seclists/Discovery/Web-Content/tomcat.txt --random-agent
```

## References

- [Apache Tomcat Security](https://tomcat.apache.org/security.html) - Security advisories and fixed version reference per branch