skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

middleware-tactics

Exploit Tomcat, WebLogic, JBoss, IIS, Nginx, and Apache middleware via weak credentials, WAR deployment, and parsing flaws.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#webshell#RCE#Tomcat#Middleware#war deployment#weblogic
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill middleware-tactics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: middleware-tactics
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/postexploit/product/middleware-tactics
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill middleware-tactics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, identifying a web middleware product is only the first step—testers still need a structured methodology to turn that fingerprint into remote code execution. This Skill provides a phase-by-phase attack decision tree for the most common Java and web middleware platforms.

Core Features & Use Cases

  • Middleware Fingerprinting: Maps ports (8080, 7001, 8009, 9990, 4848) and admin console paths to Tomcat, WebLogic, JBoss/WildFly, GlassFish, IIS, Nginx, and Apache using whatweb, curl, and nmap.
  • Attack Decision Tree: Routes each identified middleware to its applicable vectors—manager weak credentials, AJP Ghostcat, T3/IIOP deserialization, WebDAV PUT, alias traversal, and parsing vulnerabilities.
  • WAR Deployment Getshell: Covers deploying JSP/WAR webshells through Tomcat Manager, WebLogic Console, and JBoss JMX interfaces after credential access.
  • Use Case: A tester finds port 8009 (AJP) open on a Tomcat host; the Skill directs them to Ghostcat (CVE-2020-1938) file read to extract /WEB-INF/web.xml credentials.

Quick Start

Use the middleware-tactics skill to plan exploitation of the Tomcat server found on port 8080 of the authorized target.

Frequently Asked Questions about middleware-tactics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a Tomcat manager with weak credentials?▼

Test default credential pairs like tomcat/tomcat or admin/admin against the /manager/html interface, watching for account lockout policies. After successful login, deploy a WAR-packaged JSP webshell through the manager interface and access its deployed path to trigger execution.

How to exploit Tomcat AJP port 8009 with Ghostcat?▼

Ghostcat (CVE-2020-1938) abuses the exposed AJP connector on port 8009 to read files within the web application directory, such as /WEB-INF/web.xml. Tools like ajpShooter send crafted AJP requests, and file inclusion can escalate to RCE if file upload exists.

What attack vectors exist for WebLogic servers?▼

WebLogic attacks target the /console admin interface with weak credentials leading to WAR deployment, or the T3/IIOP protocols which expose numerous deserialization RCE vulnerabilities. Port 7001 is the typical fingerprint for identifying WebLogic instances.

Does IIS WebDAV PUT allow direct webshell upload?▼

IIS with WebDAV and PUT enabled often blocks direct .asp uploads, so the standard bypass uploads the payload as a .txt file first, then uses the MOVE method to rename it to .asp. This works when the server permits the MOVE verb alongside PUT.

What are Nginx parsing vulnerabilities and when do they apply?▼

Nginx parsing issues stem from misconfigurations like cgi.fix_pathinfo, which causes non-script paths to be passed to the PHP interpreter, and alias misconfiguration enabling directory traversal. They apply only when the target runs vulnerable FastCGI or alias configurations, not default hardened setups.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
bpnrockstarbpnrockstar

hunt-file-upload

Detect file upload vulnerabilities like RCE, XSS, and SSRF using bypass techniques.

Community
Advanced
trilwutrilwu
109

enumerating-network-services

Enumerate and test network services across multiple protocols to identify vulnerabilities.

Community
Advanced