Using Tomcat Manager to execute code

In Chapter 4, Testing Authentication and Session Management, we obtained the Tomcat Manager credentials and mentioned that this could lead us to execute code in the server. In this recipe, we will use such credentials to log in to the manager and upload a new application that will allow us to execute operating system commands within the server.

How to do it...

For this recipe, we come back to our OWASP BWA machine vm_1, and start from the point where we already know the credentials for the Tomcat server:

1. Browse to http://192.168.56.11:8080/manager/html and, when asked for username and password, use the ones obtained previously—root as username and owaspbwa as the password:

2. Once...