Tomcat / AJP:
Enumeration
Nmap guides for AJP fingerprinting and URI enumeration on Tomcat
Tomcat HTTP Enumeration
Enumerate Apache Tomcat & AJP services; identify versions, exposed management interfaces, default credentials, and misconfigurations using active scanning techniques.
Tomcat AJP enumeration targets the Apache JServ Protocol connector, typically on port 8009. AJP is a binary protocol designed for communication between a reverse proxy and Tomcat, but it is frequently exposed directly to the network. Nmap's ajp-methods and ajp-headers scripts detect the connector and identify available HTTP methods through it.
Version fingerprinting through AJP response headers and error pages reveals the exact Tomcat version, which maps directly to known vulnerabilities like Ghostcat. Application discovery through the AJP connector may expose deployed web applications, including the Tomcat Manager and Host Manager interfaces that are sometimes restricted on the HTTP connector but accessible through AJP.
Check whether the AJP connector has the secretRequired attribute configured. Without it, any client can send requests through AJP with full control over request attributes, which is the foundation of the Ghostcat vulnerability. The enumeration data here determines whether Ghostcat or other AJP-specific attacks are viable.