Tomcat background exploitation skills

Text/ninty

Everything is built on the ability to log on to the background ..

If the password cannot be found in the/manager/html background, try/admin background. If the/admin background exists and the weak password is entered. (The default/admin background does not exist from TOMCAT5 (it should be 5, but the specific version is forgotten .)
In the/admin background, you can view the account and password of the manager background. After obtaining the password, log on directly, or manually add the manager User Group and add an account of the manager group, you can log on to the/manager/html background.

The/admin background displays all the configuration information of TOMCAT, which may find the database connection string ..
Or you may see how many applications are deployed.

If the/manager/html background is logged in, the war file cannot be uploaded for some reason.
Use the above deploy directory or war file located on server function
Context path write/fuckfuck
War or directory url write c:

Then access
Http: // ip/fuckfuck
The directory in drive C may be listed, which is related to TOMCAT configuration. If the directory cannot be listed, just guess the file.
Here is just an example. It is better not to write it as a c: d: root directory .. Otherwise, TOMCAT copies all the files on these disks.

Or write c: WINDOWSepair in war or directory url.

Then directly access http: // ip/fuckfuck/sam
You can download the sam and system files back to crack the password ..

In addition, if there are other projects on TOMCAT, if you can guess the project directory, such
D: omcat 5.5 webappsaaa.

Use the above function war or directory url to write d: omcat 5.5webappsaaaweb-inf

Then you can directly access http: // ip/fuckfuck/web. xml to see the configuration file of the aaa project,
Read Other data based on the content in the configuration file. Generally, you can read the database connection string.

Use it by yourself ..

In another case, war files can be uploaded, but jsp files cannot be compiled. Generally, no compiler is configured or jar packages are lost ..
In this case, convert jsp into servlet, compress it into war, and then upload it directly, so that no compilation is required ..