🕺
CheatSheets
  • Introduction
  • Getting Started With Hacking
  • VMs on Mac
  • Windows
    • Enumeration
    • Local Privilege Escalation
    • UAC Bypasses
    • Persistance
    • Networking
  • Active Directory
    • Offensive Powershell
    • Enumeration
      • BloodHound
    • Lateral Movement
    • Escalation
      • ACL Abuse
      • Kerberoasting
      • Un-Constrained Delegation
      • JEA
    • Persistance
    • Mimikatz
    • Alternate Cred Dumps
    • MSSQL
    • Defences and Bypasses
    • Setting Up a Lab
  • Red Teaming
    • Phishing Payloads
    • Cobalt Strike
    • Metasploit
    • Sliver
  • Linux
    • Networking
    • Enumeration
    • Local Privilege Escalation
    • Persistance
    • MySQL
  • Mainframes
    • HP Nonstop
    • IBM z/OS
  • Cloud
    • AWS
    • GCP
    • Azure
  • Web App
    • Tomcat
    • SQLMap
    • PHP
  • Mobile
    • Android
    • iOS
  • Exploit-Dev
    • Linux
      • Basic Stack Overflows
      • Bypassing NX (DEP)
      • Bypassing ASLR
    • Shellcode
    • Windows
  • WiFi
    • Alfa AWUS036ACH Setup
    • Aircrack-ng
Powered by GitBook
On this page
  • WAR File
  • Config Files

Was this helpful?

  1. Web App

Tomcat

WAR File

# Try admin panel at:
/manager/html 

# May need to brute basic auth try basic combos:
tomcat:s3cret
tomcat:tomcat
admin:admin
admin:s3cret

# Can upload war file at the panel



# Can automate attack with msf:
use exploit/multi/http/tomcat_mgr_upload

Config Files

# Passwords
/var/lib/tomcat8/tomcat-users.xml

https://book.hacktricks.xyz/pentesting/pentesting-web/tomcat

PreviousAzureNextSQLMap

Last updated 4 years ago

Was this helpful?