tomcat-detect: Apache Tomcat Detect

日期: 2025-09-01 | 影响软件: Apache Tomcat | POC: 已公开

漏洞描述

An Apache Tomcat Manager panel was discovered. app="APACHE-Tomcat"

PoC代码[已公开]

id: tomcat-detect

info:
  name: Apache Tomcat Detect
  author: philippedelteil,dhiyaneshDk
  severity: info
  verified: true
  description: |
    An Apache Tomcat Manager panel was discovered.
    app="APACHE-Tomcat"
  tags: tomcat,detect,panel
  created: 2023/10/14

set:
  randstr: randomLowercase(12)
rules:
  r0:
    request:
      method: GET
      path: /{{randstr}}
    expression: response.raw_header.bcontains(b'tomcat') || response.body.ibcontains(b'apache tomcat') ||  response.body.ibcontains(b'/manager/html') ||  response.body.ibcontains(b'/manager/status')  ||   "Apache Tomcat.*([0-9].[0-9]+.[0-9]+)".bmatches(response.body)
    extractors:
      - type: regex
        extractor:
          ext1: '"(?i)Apache Tomcat.*(?P<version>[1-9][0-9]?\\.[0-9]+\\.([0-9]+|x))".bsubmatch(response.raw)'
          version: ext1["version"]
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/fingerprinting/tomcat-detect.yaml

相关漏洞推荐