Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Ghostcat-Tomcat-AJP-Exploit-Py3 — A fully refactored, Python 3 compatible exploit script for Tomcat Ghostcat (CVE-2020-1938 / CNVD-2020-10487) AJP Local File Inclusion | Kitploit
Tools/GitHubGitHub/si1ence90/ghostcat-tomcat-ajp-exploit-py3
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration TestingLearning & Education
GitHubsi1ence90/ghostcat-tomcat-ajp-exploit-py3

Ghostcat-Tomcat-AJP-Exploit-Py3

A fully refactored, Python 3 compatible exploit script for Tomcat Ghostcat (CVE-2020-1938 / CNVD-2020-10487) AJP Local File Inclusion

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Tomcat Ghostcat (CVE-2020-1938 / CNVD-2020-10487) Vulnerability Detection Tool

Introduction

This project provides a Python verification script for verifying the Apache Tomcat AJP protocol local file inclusion vulnerability (commonly known as Ghostcat, CVE-2020-1938 / CNVD-2020-10487).

This script is a complete refactoring and fix based on the originally circulated Python 2 version. It is fully compatible with Python 3 environments, fixing compatibility issues with StringIO, base64 encoding, and concatenation of binary data and strings, enhancing stability on modern operating systems.

Vulnerability Principle

When Apache Tomcat processes the AJP (Apache JServ Protocol) protocol, port 8009 is enabled by default, and strict security checks are not performed on incoming request attributes. Attackers can inject attributes such as javax.servlet.include.request_uri, javax.servlet.include.path_info, and javax.servlet.include.servlet_path by crafting malicious AJP requests:

  1. Arbitrary File Read (LFI): Trick Tomcat's DefaultServlet into reading any file within the web application directory (e.g., WEB-INF/web.xml, configuration files, etc.).
  2. Remote Code Execution (RCE): If the target server has a file upload vulnerability, an attacker can first upload a normal file (e.g., txt, png) containing malicious JSP code, then exploit this AJP vulnerability to force JspServlet to parse and compile that file as a JSP, thereby achieving remote command execution.

Note: This vulnerability only supports local file inclusion (LFI), not direct remote file inclusion (RFI).

Environment Requirements

  • Python 3.6+
  • Uses only Python standard library, no additional third-party dependencies required.

Usage

Command line syntax:

root@kitploit:~
python CNVD-2020-10487-Tomcat-Ajp-lfi.py <target IP> [-p target port] [-f target file path]

Parameter Description:

  • target (required): IP address or domain name of the target host.
  • -p, --port (optional): AJP port, default is 8009.
  • -f, --file (optional): Relative path of the target file to read, default is WEB-INF/web.xml.

Example Usage:

  1. Basic Check (read default web.xml):

    root@kitploit:~
    python CNVD-2020-10487-Tomcat-Ajp-lfi.py 127.0.0.1

  2. Specify port and file (read custom configuration file):

    root@kitploit:~
    python CNVD-2020-10487-Tomcat-Ajp-lfi.py 192.168.1.100 -p 8009 -f WEB-INF/classes/application.properties

Fix and Mitigation

If your system is affected by this vulnerability, it is recommended to take the following protective measures immediately:

  1. Upgrade Tomcat: Update to the official security release versions (9.0.31, 8.5.51, 7.0.100 or higher).
  2. Disable AJP service: If your business environment does not require AJP protocol for reverse proxy cluster communication, it is recommended to comment out or delete the <Connector port="8009" protocol="AJP/1.3" ... /> configuration directly in conf/server.xml.
  3. Strengthen AJP authentication: If the AJP service must be enabled, add the requiredSecret property (in Tomcat 8.5.51/9.0.31 and later versions, it's secret) to the AJP Connector to enforce authentication.

Disclaimer

This script is only for cybersecurity research, education, and internal enterprise compliance security audits. Do not use this script for unauthorized probing or attacks against targets. Users must comply with local laws and regulations when using this script. Any consequences resulting from improper or illegal use shall be borne by the user.

Download Tool