Chapter 12

1. You can identify them by using Shodan, ZoomEye, Censys.io, and similar services. You can also identify them by performing port scans and service enumeration. Sometimes, the Tomcat service won't be running on a common port (such as 80, 443, 8080, and so on). In that case, perform a full port scan and identify the service through the server response.

2. Not necessarily. The Release-Notes.txt and Changelog.html files are only available on the default installation. If the server administrator has removed these files, you need to look for other ways (mentioned in this chapter) to detect and identify the Apache Tomcat instance.

3. This generally happens when an anti-virus program detects the JSP web shell. To bypass such security measures, you can obfuscate the web shell.

4. In OOB-based OGNL injections, there are two ways that you can exploit this vulnerability—...