Metasploitable Tomcat

In this recipe, we will explore how to use Metasploit to attack a Tomcat server using the Tomcat Manager Login module. Tomcat, or Apache Tomcat, is an open source web server and servlet container used to run Java Servlets and Java Server Pages (JSP). The Tomcat server is written in pure Java. We will use Metasploit in order to brute force a Tomcat login.

Getting ready

The following requirement needs to be fulfilled:

• A connection to the internal network

• Metasploitable running in our hacking lab

• Wordlist to perform dictionary attack

How to do it...

Let's begin the recipe by opening a terminal window:

1. Open a command prompt.

2. Launch the MSFCONSOLE:

   msfconsole
   

3. Search for all the available Tomcat modules:

   search tomcat
   

   

4. Use the Tomcat Application Manager Login Utility:

   use auxiliary/scanner/http/tomcat_mgr_login
   

5. Show the available options of the module:

   show options
   

   Note

   Notice that we have a lot of items that are set to yes and are required. We will utilize their defaults.

6. Set Pass_File...