Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
tomcatfileread — CVE-2020-1938 (Ghostcat) Tomcat AJP file read/file include PoC with python3 port | Kitploit
Tools/GitHubGitHub/lem0n817/tomcatfileread
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHublem0n817/tomcatfileread

tomcatfileread

CVE-2020-1938 (Ghostcat) Tomcat AJP file read/file include PoC with python3 port

View Repository
211 month agoNot yet reviewed
Website

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2020-1938 Tomcat File Read / File Include (Ghostcat) — python3

CVE-2020-1938 (CNVD-2020-10487) Tomcat AJP protocol file read / file include vulnerability exploit POC python3 port.

Original (python2) author: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

Usage

python3 "Tomcat-ROOT路径下文件包含(CVE-2020-1938)-python3.py" -p 8009 -f /test.txt 127.0.0.1

Parameters

ParameterDescriptionDefault
targetTarget host / IPRequired
-p, --portAJP port8009
-f, --fileFile path to readWEB-INF/web.xml

Porting notes (python2 → python3)

  • import io, StringIO → io.BytesIO (AJP data is a binary byte stream)
  • .encode('base64') → base64.b64encode(...).decode('utf-8')
  • Packet serialization res changed to b"" byte concatenation
  • Response body output b"".join(...) then decoded as UTF-8

Reproduction details: http://www.svenbeast.com/post/fqSI9laE8/

Download Tool