skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

ajp-ghostcat

Exploit AJP misconfigurations and Ghostcat to read files and execute code.

253|37|Updated Feb 22, 2026
Search Tags:#web security#rce#file read#ajp#ghostcat#cve-2020-1938#apache tomcat
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill ajp-ghostcat
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ajp-ghostcat
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/ajp-ghostcat
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill ajp-ghostcat

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ajpShooter, nmap, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses vulnerabilities in Apache Tomcat's AJP connector, enabling attackers to read sensitive files, execute arbitrary code, and bypass access controls on exposed Tomcat instances.

Core Features & Use Cases

  • Ghostcat File Read (CVE-2020-1938): Read sensitive files like web.xml or configuration files from web applications.
  • Remote Code Execution: Achieve RCE by uploading a JSP payload and forcing its execution via AJP attribute injection, provided a file upload primitive exists.
  • Tomcat Manager Bypass: Use AJP proxying to bypass IP restrictions and gain access to the Tomcat Manager interface for deploying applications or further exploitation.
  • Use Case: A penetration tester discovers an exposed AJP port (8009) on a target's web server. They use this Skill to read the application.properties file, revealing database credentials, which are then used to pivot to the database.

Quick Start

Use the ajp-ghostcat skill to read the /WEB-INF/web.xml file from the target at 10.10.10.5 on port 8009.

Frequently Asked Questions about ajp-ghostcat

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Apache Tomcat AJP misconfigurations to read sensitive files?▼

Achieve remote code execution on vulnerable Apache Tomcat instances by combining a file upload primitive with AJP attribute injection. You upload a JSP payload and force its execution through the exposed AJP connector on port 8009.

What is the Ghostcat vulnerability CVE-2020-1938 in Apache Tomcat?▼

The Ghostcat vulnerability CVE-2020-1938 is an Apache Tomcat AJP connector flaw that allows attackers to read sensitive web application files. By exploiting exposed AJP ports, attackers can perform arbitrary file reads and bypass access restrictions via AJP proxying.

Can I bypass Tomcat Manager access restrictions using AJP proxying?▼

Yes, you can bypass Tomcat Manager IP restrictions using AJP proxying through an exposed AJP connector. This technique allows access to the Tomcat Manager interface for deploying applications or further exploitation without direct network access.

Do I need nmap to detect exposed AJP connectors before exploitation?▼

Yes, nmap is required to detect exposed AJP connectors on target web servers, typically found on port 8009. Identifying this open port is the necessary prerequisite step before attempting Ghostcat file reads or remote code execution.

What are the limitations when exploiting Ghostcat for remote code execution?▼

A key limitation for achieving remote code execution with Ghostcat is that a file upload primitive must already exist on the target Apache Tomcat instance. Without the ability to upload a JSP payload, exploitation is limited to arbitrary file reads.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

tech-tomcat

Audit Apache Tomcat administrative exposure, AJP security, and version vulnerabilities.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

tomcat-manager-deploy

Deploy WAR files via Apache Tomcat Manager for remote code execution.

Official
Advanced
ok-helloworldok-helloworld
241

xss-cross-site-scripting

Select context-appropriate XSS payloads for HTML, attribute, JavaScript, URL, and XML sinks.

Community
Advanced
SnailSploitSnailSploit
2.9k

ssrf

Identify and exploit SSRF vulnerabilities in web applications.

Community
Advanced