Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner — Cnvd-2020-10487 / cve-2020-1938, scanner tool | Kitploit
Tools/GitHubGitHub/bkfish/cnvd-2020-10487-tomcat-ajp-lfi-scanner
Vulnerability ScannersPort ScanningExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubbkfish/cnvd-2020-10487-tomcat-ajp-lfi-scanner

CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner

Cnvd-2020-10487 / cve-2020-1938, scanner tool

View Repository
2949344 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Python2 Multithreaded Scanning for Tomcat-Ajp Protocol File Read Vulnerability

A tool for scanning SRC rewards The PoC originates from https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi/, I am not the author of the PoC!!!!

Operation

1. Place the domain/IP to be scanned in ip.txt

Do not include the protocol in ip.txt, for example:

root@kitploit:~
127.0.0.1
www.baidu.com
www.google.com

2. python threading-find-port-8009.py

This will generate 8009.txt, used to scan the domains/IPs in ip.txt and find those with port 8009 open.

3. python threading-CNVD-2020-10487-Tomcat-Ajp-lfi.py

Filter URLs that match the vulnerability from 8009.txt and save them into vul.txt Domains present in vul.txt are those containing the vulnerability Personally tested, there are hundreds of sites on Butian public SRC and about three hundred on education SRC containing this vulnerability.

4. Testing

Just use CNVD-2020-10487-Tomcat-Ajp-lfi.py to test python CNVD-2020-10487-Tomcat-Ajp-lfi.py target.com

This project is for learning purposes only, strictly prohibited for illegal use

ps1: The last line of both scripts is the thread count - default is 20, can be modified manually
Located at line 67 of threading-find-port-8009.py

Line 341 of threading-CNVD-2020-10487-Tomcat-Ajp-lfi.py

root@kitploit:~
thread_num=20

ps2: The domain collection folder in the SRC section contains some domains I collected from education SRC and Butian SRC, which can be tested directly.

Download Tool