Tomcat / AJP:

Exploitation

Guides on deploying malicious WAR files via Tomcat Manager

1 guide • Created Mar 30, 2026 • Updated Mar 30, 2026

1 guide

Tomcat Manager WAR Deployment

Deploy malicious WAR files via Tomcat Manager to gain remote code execution, exploiting weak credentials or misconfigurations in exposed management interfaces.

Mar 30, 2026 • 5 min read

Tomcat AJP exploitation centers on the Ghostcat vulnerability (CVE-2020-1938), one of the most impactful Tomcat findings. Ghostcat allows an attacker to read any file within the web application directory through the AJP connector by manipulating javax.servlet.include.* request attributes. This means reading WEB-INF/web.xml, source code, configuration files, and database credentials without authentication.

When the target allows JSP file uploads (even to a non-executable location), Ghostcat escalates from file read to remote code execution by processing the uploaded file as a JSP through the AJP include mechanism. AJP request smuggling through mismatches between the proxy and Tomcat's parsing of AJP packets is another avenue on specific versions.

Tomcat Manager deployment abuse through AJP works when the Manager application is deployed and accessible via the AJP connector, even if the HTTP port restricts it. Default credentials (tomcat/tomcat, admin/admin) or brute-forced credentials let you deploy a malicious WAR file for a full shell. Tools like ajpShooter and pyfuscern automate the Ghostcat exploitation chain.