Exploiting Tomcat

In this section, we will look at how the exploitation of vulnerable versions of Tomcat can be performed. We will cover various techniques, including uploading a WAR shell and the JSP upload bypass.

Using the search command on Metasploit to look up Tomcat will provide us with a few available modules, as shown:

We will use the most basic module, which will brute-force Tomcat Manager and give us the credentials:

1. To load the module, we can use the following command:

use auxiliary/scanner/http/tomcat_mgr_login

2. Before using a module, it's always good practice to know the workings of the module. Keeping that in mind, a pentester can tweak the module in case there's a Web Application Firewall (WAF) in place. Once the module is loaded, we can use the show options command to view the options that need to be filled in by the tester (as in the following screenshot...