woaiqiukui/cve-2020-1938tomcatajpscanner批量扫描TomcatAJP漏洞
Batch scan for Tomcat AJP vulnerability
On January 6, 2020, the National Information Security Vulnerability Sharing Platform (CNVD) included the Apache Tomcat file inclusion vulnerability (CNVD-2020-10487, corresponding to CVE-2020-1938). Attackers exploiting this vulnerability can remotely read any file in a specific directory without authorization. Currently, the vulnerability details have not been disclosed, and the vendor has released a new version to fix the vulnerability.
https://mp.weixin.qq.com/s/8Wueh4lkKBtfNisjxOSoWA
python CVE-2020-1938TomcatAjpScanner -h Can view usage instructions usage: CVE-2020-1938TomcatAjpScanner.py [-h] [-p PORT] [-f FILE] [-z ZIZHAN] target
Usage: python CVE-2020-1938TomcatAjpScanner.py target [-p port] The target is an IP address, which can be a string or a file; scan results will be saved in result.txt in the current directory. Supports Python3.
positional arguments: target Hostname or IP to attack---Support Inputting a txt file
optional arguments: -h, --help show this help message and exit -p PORT, --port PORT AJP port to attack (default is 8009) -f FILE, --file FILE file path :(WEB-INF/web.xml) -z ZIZHAN, --zizhan ZIZHAN zizhan path :(woaiqiukui)
[!] Note: Be aware of file name conflicts when using. To prevent content conflicts, manually clear the result.txt file before reusing. [!] Note: Ensure the IP format is correct, do not pass a directory.
usage:
test.txt:
display:
result.txt:
