{"id":2156,"date":"2021-01-09T15:06:34","date_gmt":"2021-01-09T14:06:34","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=2156"},"modified":"2021-01-09T15:06:34","modified_gmt":"2021-01-09T14:06:34","slug":"8009-tomcat-jserv","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=2156","title":{"rendered":"8009 Tomcat JServ"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Enumeration<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Mandatory<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>Check on the <em><span class=\"caps\">HTTP<\/span> port 8080<\/em> if <em>\/manager<\/em> is acces\u00adsi\u00adble (default cre\u00adden\u00adtials: <em>tom\u00adcat \/ s3cret <\/em>or <em>admin \/ admin<\/em>).<ol><li>If yes, upload a reverse shell <span class=\"caps\">WAR<\/span>&nbsp;file.<\/li><\/ol><\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Optional<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Try to brute-force with <code>msf&gt; use scanner\/http\/tomcat_mgr_login<\/code>.<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Enu\u00admer\u00ada\u00adtion Manda\u00adto\u00adry Check on the <span class=\"caps\">HTTP<\/span> port 8080 if \/manager is acces\u00adsi\u00adble (default cre\u00adden\u00adtials: tom\u00adcat \/ s3cret or admin \/ admin). If yes, upload a reverse shell <span class=\"caps\">WAR<\/span>&nbsp;file. Option\u00adal Try to brute-force with msf&gt; use scanner\/http\/tomcat_mgr_login.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[36],"tags":[330,37,250,249],"class_list":["post-2156","post","type-post","status-publish","format-standard","hentry","category-port","tag-ajp","tag-checklist","tag-jserv","tag-tomcat"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2156"}],"version-history":[{"count":1,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2156\/revisions"}],"predecessor-version":[{"id":2157,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/2156\/revisions\/2157"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}