Mastering Python for Networking and Security

Exploiting the Tomcat service with Metasploit

In the Metasploitable virtual machine environment is installed an apache tomcat service, which is vulnerable to several attacks by remote attackers. A first attack can be the brute-force one, starting from a list of words, to try to capture the access credentials to the Tomcat Application Manager (the Tomcat Application Manager allows us to see and manage the applications installed in the server). If the execution of this module is successful, it will provide a valid username and password to access the server.

In the Metasploit Framework, there is an auxiliary module named tomcat_mgr_login, which provides the attacker, if its execution is successful, a username and password to access Tomcat Manager. ...