# ApacheTomcatScanner | A Python Script To Scan For Apache Tomcat Server Vulnerabilities

**URL:** <https://onehack.st/t/apachetomcatscanner-a-python-script-to-scan-for-apache-tomcat-server-vulnerabilities/223638>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, cracking, freebies, windows\
**Created:** [September 8, 2022, 10:58pm UTC](https://onehack.st/t/apachetomcatscanner-a-python-script-to-scan-for-apache-tomcat-server-vulnerabilities/223638 "2022-09-08T22:58:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [September 8, 2022, 10:58pm UTC](https://onehack.st/t/apachetomcatscanner-a-python-script-to-scan-for-apache-tomcat-server-vulnerabilities/223638/1 "2022-09-08T22:58:02Z")

</div>

[![](https://github.com/p0dalirius/ApacheTomcatScanner/raw/main/.github/banner.png)](https://github.com/p0dalirius/ApacheTomcatScanner/blob/main/.github/banner.png)

A python script to scan for Apache Tomcat server vulnerabilities.  
[![PyPI](https://camo.githubusercontent.com/2d789f84cda7ad84087d07c2bec11a484129ba80732acc710802b155b2c5f6d9/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f617061636865746f6d6361747363616e6e6572)](https://camo.githubusercontent.com/2d789f84cda7ad84087d07c2bec11a484129ba80732acc710802b155b2c5f6d9/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f617061636865746f6d6361747363616e6e6572) [![GitHub release (latest by date)](https://camo.githubusercontent.com/6998f48759b4064d9ce246487ea6c89aaea5b79a4be5fdb5dcbecc2cb06d8112/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f417061636865546f6d6361745363616e6e6572)](https://camo.githubusercontent.com/6998f48759b4064d9ce246487ea6c89aaea5b79a4be5fdb5dcbecc2cb06d8112/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f703064616c69726975732f417061636865546f6d6361745363616e6e6572) [![Python pip build](https://github.com/p0dalirius/ApacheTomcatScanner/actions/workflows/python-pip-build.yml/badge.svg)](https://github.com/p0dalirius/ApacheTomcatScanner/actions/workflows/python-pip-build.yml/badge.svg) [![](https://camo.githubusercontent.com/b10eb64ea9c513e01a8f68ba2f60cab855d32eace20c7a0de41f4d0df41394da/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f706f64616c69726975735f3f6c6162656c3d506f64616c6972697573267374796c653d736f6369616c)](https://twitter.com/intent/follow?screen_name=podalirius_) [![YouTube Channel Subscribers](https://camo.githubusercontent.com/ba5ae186e8603121f9a0c6485c5d220b579b4653c0017a2b84320a6e87839d92/68747470733a2f2f696d672e736869656c64732e696f2f796f75747562652f6368616e6e656c2f73756273637269626572732f5543465f78354f3743536672383241664e56544b4f765f413f7374796c653d736f6369616c)](https://www.youtube.com/c/Podalirius_?sub_confirmation=1)

## Features

- Multithreaded workers to search for Apache tomcat servers.
- Multiple target source possible:
  - Retrieving list of computers from a Windows domain through an LDAP query to use them as a list of targets.
  - Reading targets line by line from a file.
  - Reading individual targets (IP/DNS/CIDR) from `-tt/--target` option.

- Custom list of ports to test.
- Tests for `/manager/html` access and default credentials.
- List the CVEs of each version with the `--list-cves` option

## Installation

You can now install it from pypi (latest version is [![PyPI](https://camo.githubusercontent.com/2d789f84cda7ad84087d07c2bec11a484129ba80732acc710802b155b2c5f6d9/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f617061636865746f6d6361747363616e6e6572)](https://camo.githubusercontent.com/2d789f84cda7ad84087d07c2bec11a484129ba80732acc710802b155b2c5f6d9/68747470733a2f2f696d672e736869656c64732e696f2f707970692f762f617061636865746f6d6361747363616e6e6572)) with this command:

```auto
sudo python3 -m pip install apachetomcatscanner

```

## Usage

```auto
$ ./ApacheTomcatScanner.py -h
Apache Tomcat Scanner v2.3.2 - by @podalirius_

usage: ApacheTomcatScanner.py [-h] [-v] [--debug] [-C] [-T THREADS] [-s] [--only-http] [--only-https] [--no-check-certificate] [--xlsx XLSX] [--json JSON] [-PI PROXY_IP] [-PP PROXY_PORT] [-rt REQUEST_TIMEOUT] [-tf TARGETS_FILE]
                              [-tt TARGET] [-tp TARGET_PORTS] [-ad AUTH_DOMAIN] [-ai AUTH_DC_IP] [-au AUTH_USER] [-ap AUTH_PASSWORD] [-ah AUTH_HASH]

A python script to scan for Apache Tomcat server vulnerabilities.

optional arguments:
  -h, --help show this help message and exit
  -v, --verbose Verbose mode. (default: False)
  --debug Debug mode, for huge verbosity. (default: False)
  -C, --list-cves List CVE ids affecting each version found. (default: False)
  -T THREADS, --threads THREADS
                        Number of threads (default: 5)
  -s, --servers-only If querying ActiveDirectory, only get servers and not all computer objects. (default: False)
  --only-http Scan only with HTTP scheme. (default: False, scanning with both HTTP and HTTPs)
  --only-https Scan only with HTTPs scheme. (default: False, scanning with both HTTP and HTTPs)
  --no-check-certificate
                        Do not check certificate. (default: False)
  --xlsx XLSX Export results to XLSX
  --json JSON Export results to JSON

  -PI PROXY_IP, --proxy-ip PROXY_IP
                        Proxy IP.
  -PP PROXY_PORT, --proxy-port PROXY_PORT
                        Proxy port
  -rt REQUEST_TIMEOUT, --request-timeout REQUEST_TIMEOUT

  -tf TARGETS_FILE, --targets-file TARGETS_FILE
                        Path to file containing a line by line list of targets.
  -tt TARGET, --target TARGET
                        Target IP, FQDN or CIDR
  -tp TARGET_PORTS, --target-ports TARGET_PORTS
                        Target ports to scan top search for Apache Tomcat servers.
  -ad AUTH_DOMAIN, --auth-domain AUTH_DOMAIN
                        Windows domain to authenticate to.
  -ai AUTH_DC_IP, --auth-dc-ip AUTH_DC_IP
                        IP of the domain controller.
  -au AUTH_USER, --auth-user AUTH_USER
                        Username of the domain account.
  -ap AUTH_PASSWORD, --auth-password AUTH_PASSWORD
                        Password of the domain account.
  -ah AUTH_HASH, --auth-hash AUTH_HASH
                        LM:NT hashes to pass the hash for this user.

```

## Example

[![](https://github.com/p0dalirius/ApacheTomcatScanner/raw/main/.github/example.png)](https://github.com/p0dalirius/ApacheTomcatScanner/blob/main/.github/example.png)

You can also list the CVEs of each version with the `--list-cves` option:

[![](https://github.com/p0dalirius/ApacheTomcatScanner/raw/main/.github/example_list_cves.png)](https://github.com/p0dalirius/ApacheTomcatScanner/blob/main/.github/example_list_cves.png)

## Contributing

Pull requests are welcome. Feel free to open an issue if you want to add other features.

## GitHub:

[https://github.com/p0dalirius/ApacheTomcatScanner](https://github.com/p0dalirius/ApacheTomcatScanner)