Basic Tomcat Info
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Avoid to run with root
In order to not run Tomcat with root a very common configuration is to set an Apache server in port 80/443 and, if the requested path matches a regexp, the request is sent to Tomcat running on a different port.
Default Structure
The
bin
folder stores scripts and binaries needed to start and run a Tomcat server.The
conf
folder stores various configuration files used by Tomcat.The
tomcat-users.xml
file stores user credentials and their assigned roles.The
lib
folder holds the various JAR files needed for the correct functioning of Tomcat.The
logs
andtemp
folders store temporary log files.The
webapps
folder is the default webroot of Tomcat and hosts all the applications. Thework
folder acts as a cache and is used to store data during runtime.
Each folder inside webapps
is expected to have the following structure.
The most important file among these is WEB-INF/web.xml
, which is known as the deployment descriptor. This file stores information about the routes used by the application and the classes handling these routes.
All compiled classes used by the application should be stored in the WEB-INF/classes
folder. These classes might contain important business logic as well as sensitive information. Any vulnerability in these files can lead to total compromise of the website. The lib
folder stores the libraries needed by that particular application. The jsp
folder stores Jakarta Server Pages (JSP), formerly known as JavaServer Pages
, which can be compared to PHP files on an Apache server.
Here’s an example web.xml file.
The web.xml
configuration above defines a new servlet named AdminServlet
that is mapped to the class com.inlanefreight.api.AdminServlet
. Java uses the dot notation to create package names, meaning the path on disk for the class defined above would be:
classes/com/inlanefreight/api/AdminServlet.class
Next, a new servlet mapping is created to map requests to /admin
with AdminServlet
. This configuration will send any request received for /admin
to the AdminServlet.class
class for processing. The web.xml
descriptor holds a lot of sensitive information and is an important file to check when leveraging a Local File Inclusion (LFI) vulnerability.
tomcat-users
The tomcat-users.xml
file is used to allow or disallow access to the /manager
and host-manager
admin pages.
The file shows us what each of the roles manager-gui
, manager-script
, manager-jmx
, and manager-status
provide access to. In this example, we can see that a user tomcat
with the password tomcat
has the manager-gui
role, and a second weak password admin
is set for the user account admin
References
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated