{"id":33245125,"url":"https://github.com/edermi/go-tomcat-mgmt-scanner","last_synced_at":"2025-12-06T06:01:30.450Z","repository":{"id":140025086,"uuid":"144501562","full_name":"edermi/go-tomcat-mgmt-scanner","owner":"edermi","description":"A simple scanner to find and brute force tomcat manager logins","archived":true,"fork":false,"pushed_at":"2019-12-11T22:32:25.000Z","size":2227,"stargazers_count":28,"open_issues_count":6,"forks_count":6,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-06-20T09:08:32.243Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/edermi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-08-12T21:19:09.000Z","updated_at":"2023-02-12T17:57:38.000Z","dependencies_parsed_at":"2024-01-07T09:46:33.062Z","dependency_job_id":null,"html_url":"https://github.com/edermi/go-tomcat-mgmt-scanner","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/edermi/go-tomcat-mgmt-scanner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/edermi%2Fgo-tomcat-mgmt-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/edermi%2Fgo-tomcat-mgmt-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/edermi%2Fgo-tomcat-mgmt-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/edermi%2Fgo-tomcat-mgmt-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/edermi","download_url":"https://codeload.github.com/edermi/go-tomcat-mgmt-scanner/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/edermi%2Fgo-tomcat-mgmt-scanner/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27536560,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-06T02:00:06.463Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-11-16T21:00:32.218Z","updated_at":"2025-12-06T06:01:30.444Z","avatar_url":"https://github.com/edermi.png","language":"Go","funding_links":[],"categories":["Pentesting"],"sub_categories":["ARM"],"readme":"# go-tomcat-mgmt-scanner\n\nA small tool to find and brute force tomcat manager logins.\n\nCurrent project version: 2.0\n\n# About\n\nA simple brute force scanner that tries to identify tomcat manager applications. If such a manager is found, it tries to find valid login credentials by trying common combinations.\nThe initial wordlists for credential brute forcing are those from Metasploit. The scanner supports userpass files containing `\u003cuser\u003e:\u003cpassword\u003e` entries and files containing solely usernames or passwords which are tried in every possible combination. **There is currently no logic to check if found applications are actually Tomcat manager login pages**. This means that the scanner may also be used to brute force any HTTP auth.\n\n# Build\n\nGo \u003e= 1.12 should work.\n\n## Docker (easy)\n\n`docker run --rm -v \"$PWD\":/build -w /build golang:latest make release`\n\n## Manually (needs go installed)\n\n```\n$ go get -u github.com/edermi/go-tomcat-mgmt-scanner\n$ make # builds for some architectures/platforms and drops binaries to build/\n\n# or\n\n$ env GOOS=linux GOARCH=arm GOARM=7 go build # Raspberry Pi\n$ env GOOS=windows GOARCH=amd64 go build # x64 Windows\n$ env GOOS=linux GOARCH=amd64 go build # x64 linux\n$ ....\n```\n\n# Usage\n\nExample: `./go-tomcat-mgmt-scanner -target 172.16.10.0/24 -ports 80,443 -concurrency 1000 -timeout 2000ms -debug`\n\nCommand line options: \n\n```\n  -avoid-lockout\n    \tTry to avoid lockout by waiting Tomcat's default lockout treshold between tries. Your scan may get suuuper slow, but in the end, success matters.\n  -concurrency uint\n    \tConcurrent Goroutines to use. Due to kernel limitations on linux, it should not be more than 'ulimit -n / 7'. (default 100)\n  -debug\n    \tEnable debugging output.\n  -ignoreInsecure\n    \tIgnore certificate errors. If you only want secure connections, set this to false. (default true)\n  -managerpath string\n    \tManager path. (default \"/manager/html\")\n  -passfile string\n    \tA file containing passwords to test. Requires also a userfile. If neither user-, password- and userpass list is given, the default lists from Metasploit project are used.\n  -ports string\n    \tComma separated list of target ports. (default \"8080,8443,80,443,8000,8888\")\n  -target string\n    \tThe target network range in CIDR notation, e.g. 10.10.10.0/24\n  -timeout duration\n    \tHTTP timeout. Specify with unit suffix, e.g. '2500ms' or '3s'. (default 2s)\n  -userfile string\n    \tA file containing user names to test. Requires also a passfile. If neither user-, password- and userpass list is given, the default lists from Metasploit project are used.\n  -userpassfile string\n    \tA file containing username:password combinations. If neither user-, password- and userpass list is given, the default lists from Metasploit project are used.\n```\n\n# License\n\nSee LICENSE. User and password lists are taken from Metasploit project which are licensed BSD 3-clause.\n\n# DISCLAIMER\n\nThe usual stuff. Don't do bad things and only use it against targets you are permitted to attack. You are on your own if something breaks.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Federmi%2Fgo-tomcat-mgmt-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Federmi%2Fgo-tomcat-mgmt-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Federmi%2Fgo-tomcat-mgmt-scanner/lists"}