Ctrlk
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Apache Jserv Protocol (AJP) - Port 8009

Basic info

What is AJP?

Apache JServ Protocol (AJP) is a wire protocol optimized for communication between web servers and servlet containers. It was designed to address a fundamental problem in early Java web deployments: Apache HTTP Server was significantly faster at serving static content than Tomcat, but Tomcat was required for Java servlets and JSPs.

AJP Architecture

┌─────────────────┐         AJP/1.3          ┌─────────────────┐
│   Web Server    │ ───────────────────────> │     Tomcat      │
│  (Apache/Nginx) │  Binary Protocol (8009)  │Servlet Container│
└─────────────────┘ <─────────────────────── └─────────────────┘
     HTTP/HTTPS                                   Java Apps
     (80/443)                                     JSP/Servlets
        │                                              │
        V                                              V
   Static Content                               Dynamic Content

Key Design Principles:

  1. Binary format - More efficient than HTTP plain text

  2. Connection persistence - TCP connections are reused for multiple requests

  3. Optimized for backend communication - Not designed for public exposure

  4. Minimal overhead - Reduces parsing and processing time

Protocol Versions

  • AJP/1.2 - Original version (obsolete)

  • AJP/1.3 - Current standard (ajp13)

  • AJP/1.4 - Proposed but never widely adopted

How AJP Works

  1. Connection Establishment: Web server creates persistent TCP connection to Tomcat

  2. Request Forwarding: Web server converts HTTP request to AJP binary format

  3. Processing: Tomcat processes the request and generates response

  4. Response Return: Response sent back through AJP connection

  5. Connection Reuse: Connection stays open for next request

Common Use Cases

  • Load Balancing - Distribute requests across multiple Tomcat instances

  • Static/Dynamic Separation - Apache serves static, Tomcat serves dynamic

  • SSL Termination - Apache handles SSL, forwards to Tomcat via AJP

  • Reverse Proxy - Hide Tomcat behind Apache/Nginx

Default Port

Default Port: 8009

Reconnaissance & Enumeration

Port Scanning

Basic Nmap Scan

Sample Output:

Nmap Script Enumeration

AJP-Auth Script

AJP-Headers Script

AJP-Methods Script

AJP-Request Script

All AJP Scripts

Using Netcat

Using Telnet

Service Identification

Check for Tomcat

Shodan Queries

Find exposed AJP instances:

Ghostcat Vulnerability (CVE-2020-1938)

Overview

CVE-2020-1938 (nicknamed "Ghostcat") is a critical file read/inclusion vulnerability in Apache Tomcat's AJP connector. It allows an attacker to read arbitrary files from the web application's file system, including sensitive configuration files.

Severity: Critical (CVSS 9.8)

Affected Versions:

  • Apache Tomcat 9.x < 9.0.31

  • Apache Tomcat 8.x < 8.5.51

  • Apache Tomcat 7.x < 7.0.100

  • Apache Tomcat 6.x (all versions - EOL)

Patched Versions:

  • Apache Tomcat 9.0.31+

  • Apache Tomcat 8.5.51+

  • Apache Tomcat 7.0.100+

How Ghostcat Works

The vulnerability exists in the way AJP handles file inclusion requests. An attacker can craft malicious AJP requests to:

  1. Request arbitrary files from the web application directory

  2. Read files outside the web root (in some configurations)

  3. Include files that may contain sensitive information

  4. Potentially achieve RCE if file upload is possible

Vulnerability Detection

Method 1: Using Nmap NSE Script

Method 2: Using Metasploit

Method 3: Manual Version Check

Exploitation

Method 1: Using Public Exploit

Method 2: Using Alternative Exploit

Method 3: Using Exploit-DB Exploit

Method 4: Using Metasploit

Files to Target

High-Value Configuration Files:

Example WEB-INF/web.xml Content:

From File Read to RCE

Scenario 1: Upload + Include

If the application has file upload functionality:

Scenario 2: Credential Extraction + Manager Access

Scenario 3: Database Credentials + SQL Injection

AJP Proxy Exploitation

Overview

AJP proxying allows you to interact with Tomcat's AJP port as if it were an HTTP port. This enables:

  • Access to Tomcat Manager interface

  • Browsing web applications

  • Exploiting web vulnerabilities

  • File upload and RCE

Method 1: Nginx Reverse Proxy

Setup Nginx with AJP Module

Configure Nginx

Start Nginx

Access Tomcat via Proxy

Method 2: Nginx Docker (Easier)

Using Pre-built Docker Image

Build and Run

Alternative: Docker One-Liner

Method 3: Apache AJP Proxy

Install Apache with mod_proxy_ajp

Configure Apache

Enable and Access

Method 4: Using ajp-spray

Simple Python AJP Client

Post-Proxy Exploitation

Tomcat Manager Access

Once you've set up the AJP proxy, you can access Tomcat Manager:

Brute Force Manager Credentials

Access Manager Interface

WAR File Upload for RCE

Create Malicious WAR File

Upload WAR File

Reverse Shell

Alternative: Using Metasploit for WAR Upload

Advanced Techniques

AJP Request Smuggling

AJP can be vulnerable to request smuggling similar to HTTP:

Concept:

Example Attack:

AJP Attributes Injection

AJP allows setting request attributes that can bypass security checks:

Example Using Python AJP Client:

Exploiting AJP Secret Mismatch

In Tomcat 8.5.51+ and 9.0.31+, AJP can use a shared secret for authentication:

If secret is weak or guessable:

AJP Connection Hijacking

If AJP connections are not properly secured:

Common Misconfigurations

1. Exposed to Internet

Problem: AJP listening on 0.0.0.0

Impact: Remote file read, RCE via Ghostcat

Fix:

2. No Secret Authentication

Problem: AJP without shared secret (pre-patch versions)

Impact: Unauthenticated access

Fix:

3. Weak or Default Secrets

Problem: Using predictable secrets

Impact: Secret can be brute-forced

Fix:

4. Tomcat Manager with Weak Credentials

Problem: Default or weak Manager credentials

Impact: WAR upload → RCE

Fix:

5. Allowing PUT/DELETE Methods

Problem: Dangerous HTTP methods enabled

Impact: Potential file upload/deletion

Check:

Fix:

Defense & Hardening

Secure AJP Configuration

server.xml Configuration (Tomcat 9.0.31+)

Key Security Settings:

Network-Level Protection

Firewall Rules

Disable AJP if Not Needed

Update to Patched Versions

Check Current Version:

Update Tomcat:

Verify Patch:

Secure Tomcat Manager

Remove Default Accounts:

Restrict Manager Access by IP:

Disable Manager if Not Needed:

Monitoring & Detection

Enable Access Logging:

Monitor AJP Connections:

Log Analysis:

Intrusion Detection (Snort Rule):

OSSEC/Wazuh Rule:

Regular Security Audits

Tools & Scripts

Essential Tools

  1. nmap - Port scanning and enumeration

  2. Metasploit - Exploitation framework

  3. Ghostcat exploits - Various Python exploits

  4. Nginx/Apache - AJP proxy setup

  5. ajpy - Python AJP library

  6. tomcat-ajp-lfi - Ghostcat exploitation tool

Custom Python AJP Client

Automated Exploitation Script

Cheat Sheet

Quick Reference

Important Files to Target

Common Ports

  • 8009 - AJP default

  • 8080 - Tomcat HTTP

  • 8443 - Tomcat HTTPS

  • 8005 - Tomcat Shutdown port

Conclusion

The Apache JServ Protocol (AJP), while designed for performance optimization, introduces significant security risks when misconfigured. The Ghostcat vulnerability (CVE-2020-1938) demonstrates how a simple oversight in security design can lead to critical vulnerabilities affecting millions of Tomcat instances worldwide.

Key Takeaways:

  1. Never expose AJP to the internet - Bind to 127.0.0.1 only

  2. Update Tomcat to patched versions (9.0.31+, 8.5.51+, 7.0.100+)

  3. Use AJP secrets (secretRequired="true")

  4. Firewall AJP port - Allow only trusted sources

  5. Disable AJP if not needed

  6. Secure Tomcat Manager - Strong credentials, IP restrictions

  7. Monitor AJP traffic - Detect exploitation attempts

  8. Regular security audits - Verify configuration and patches

  9. Principle of least privilege - Limit Tomcat user permissions

  10. Defense in depth - Multiple layers of security

Common Attack Vectors:

  • Ghostcat (CVE-2020-1938) for arbitrary file read

  • AJP proxy to access Tomcat Manager

  • WAR file upload for RCE

  • Request smuggling and attribute injection

  • Credential theft from configuration files

Remember to only use these techniques during authorized security assessments. Unauthorized access is illegal and unethical.

Additional Resources

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉
PreviousRedis - Port 6379
NextInfluxDB - Port 8086

Last updated