skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-ajp

Tests AJP13 connectors on port 8009 for Ghostcat LFI, secret brute forcing, and Tomcat Manager access.

954|172|Updated Mar 13, 2026
Search Tags:#pentesting#network-security#Nmap#ajp#ghostcat#cve-2020-1938#Tomcat
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ajp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-ajp
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-ajp
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ajp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Exposed AJP (Apache JServ Protocol) connectors on port 8009 are frequently misconfigured and vulnerable to Ghostcat (CVE-2020-1938), trusted-attribute abuse, and weak secrets, yet they are often overlooked during authorized penetration tests because testers focus only on HTTP ports.

Core Features & Use Cases

  • AJP Enumeration: Uses nmap AJP NSE scripts (ajp-auth, ajp-headers, ajp-methods, ajp-request) to fingerprint the connector, Tomcat version, and enforced secret/attribute policies.
  • Ghostcat Exploitation: Crafts ForwardRequest packets with AJPFuzzer to read files like WEB-INF/web.xml, harvest credentials, and brute-force the AJP secret required by patched Tomcat versions.
  • Proxy Pivoting: Configures nginx ajp_module or Apache mod_proxy_ajp to reach the Tomcat Manager through AJP and deploy a WAR for RCE.
  • Use Case: During an authorized engagement, nmap shows 8009/tcp open ajp13 but 8080 is filtered; the tester confirms Ghostcat, extracts Manager credentials from web.xml, proxies to /manager/html, and deploys a WAR webshell.

Quick Start

Ask the AI to enumerate and test the AJP service on port 8009 of the authorized target for Ghostcat and Tomcat Manager exposure.

Frequently Asked Questions about pentesting-ajp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test AJP port 8009 for Ghostcat CVE-2020-1938?▼

Use nmap AJP NSE scripts to fingerprint the service, then send a crafted ForwardRequest with AJPFuzzer setting javax.servlet.include.path_info to /WEB-INF/web.xml. If the file contents return instead of a 403/404, the Tomcat instance is vulnerable to Ghostcat.

What tools are used for AJP penetration testing?▼

The main tools are nmap with ajp-auth, ajp-headers, ajp-methods, and ajp-request NSE scripts for enumeration, AJPFuzzer from Doyensec for crafting ForwardRequest packets and fuzzing secrets, and nginx ajp_module or Apache mod_proxy_ajp for proxying to the Tomcat Manager.

Which Tomcat versions are vulnerable to Ghostcat?▼

Ghostcat (CVE-2020-1938) affects Tomcat versions before 9.0.31, 8.5.51, and 7.0.100. Any AJP connector on port 8009 reachable from an untrusted network running an unpatched version is a high-value target.

How do I reach Tomcat Manager when port 8080 is filtered?▼

Set up an AJP proxy using nginx with the third-party ajp_module or Apache mod_proxy_ajp pointing at the target's port 8009. Browsing the local proxy then exposes /manager/html, allowing WAR deployment for remote code execution.

Why does Tomcat return 403 for AJP request attributes?▼

Modern Tomcat rejects unknown AJP request attributes with 403 unless they match the allowedRequestAttributesPattern regex. A permissive pattern is worth investigating, and post-Ghostcat versions also require an AJP secret that can be brute-forced with AJPFuzzer.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

ajp-ghostcat

Exploit AJP misconfigurations and Ghostcat to read files and execute code.

Official
Advanced
blacklanternsecurityblacklanternsecurity
253

tomcat-manager-deploy

Deploy WAR files via Apache Tomcat Manager for remote code execution.

Official
Advanced
first-flukefirst-fluke
1.2k

tf-infra-agent

Automates Terraform provisioning across AWS, GCP, Azure, and Oracle Cloud infrastructure.

Official
Advanced
storyclaw-officialstoryclaw-official

tavily-search

Search the web via Tavily's LLM-optimized API for current information.

Official
Intermediate