# Ajp Pentesting

> Pentest Apache JServ Protocol (AJP) services on port 8009. Use this skill whenever the user mentions AJP, Tomcat port 8009, Ghostcat vulnerability, or needs to enumerate/exploit AJP endpoints. This skill covers AJP protocol enumeration, CVE-2020-1938 Ghostcat exploitation, and AJP proxy setup for accessing Tomcat Manager.

- Skill: `abelrguezr/ajp-pentesting` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ajp-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ajp-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ajp-pentesting

---


# AJP Pentesting Skill

A comprehensive guide for pentesting Apache JServ Protocol (AJP) services, typically running on port 8009.

## What is AJP?

AJP (Apache JServ Protocol) is a binary wire protocol optimized for communication between web servers (like Apache) and servlet containers (like Tomcat). It's designed for performance with persistent TCP connections.

**Key characteristics:**
- Default port: **8009/tcp**
- Binary packet-oriented protocol
- Used for Apache ↔ Tomcat communication
- Often exposed unintentionally in production environments

## Quick Start

```bash
# Check if AJP port is open
nmap -p 8009 <TARGET_IP>

# Full enumeration with AJP scripts
nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 <TARGET_IP>
```

## Enumeration

### Automated Nmap Scanning

Use the `enumerate-ajp.sh` script for comprehensive AJP enumeration:

```bash
./scripts/enumerate-ajp.sh <TARGET_IP>
```

This runs:
- `ajp-auth` - Check for authentication requirements
- `ajp-headers` - Extract server headers
- `ajp-methods` - Discover supported HTTP methods
- `ajp-request` - Send test requests

### Manual Enumeration

```bash
# Basic port check
nmap -p 8009 <IP>

# Version detection
nmap -sV -p 8009 <IP>

# Full AJP script suite
nmap -sV --script ajp-auth,ajp-headers,ajp-methods,ajp-request -n -p 8009 <IP>
```

### Brute Force

If authentication is detected, attempt brute force attacks against the AJP endpoint. Refer to generic brute force techniques for credential testing.

## CVE-2020-1938 Ghostcat Vulnerability

**Critical LFI vulnerability** affecting Apache Tomcat that allows reading arbitrary files including `WEB-INF/web.xml` (often contains credentials).

### Affected Versions

- Tomcat 9.0.0 - 9.0.30
- Tomcat 8.5.0 - 8.5.50
- Tomcat 7.0.0 - 7.0.99

### Patched Versions

- Tomcat 9.0.31+
- Tomcat 8.5.51+
- Tomcat 7.0.100+

### Exploitation

If the target is running a vulnerable version:

1. **Check Tomcat version** via nmap or banner grabbing
2. **Use the exploit** from [Exploit-DB #48143](https://www.exploit-db.com/exploits/48143)
3. **Target sensitive files**:
   - `WEB-INF/web.xml` - Often contains database credentials
   - `WEB-INF/classes/*` - Application source code
   - `/etc/passwd` - System files (if accessible)

### Example Exploitation

```bash
# Using the Ghostcat exploit
python3 ghostcat.py <TARGET_IP> 8009 /WEB-INF/web.xml

# Or with curl through AJP proxy (see below)
curl http://127.0.0.1/WEB-INF/web.xml
```

## AJP Proxy Setup

To interact with AJP endpoints using standard HTTP tools, set up an AJP proxy.

### Option 1: Nginx with AJP Module

Use the `setup-nginx-ajp-proxy.sh` script for automated setup:

```bash
./scripts/setup-nginx-ajp-proxy.sh <TARGET_IP>
```

### Manual Nginx Setup

1. **Clone and compile Nginx with AJP module:**

```bash
git clone https://github.com/dvershinin/nginx_ajp_module.git
cd nginx-version
sudo apt install libpcre3-dev
./configure --add-module=`pwd`/../nginx_ajp_module \
  --prefix=/etc/nginx \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib/nginx/modules
make
sudo make install
```

2. **Configure Nginx** (`/etc/nginx/conf/nginx.conf`):

```nginx
upstream tomcats {
    server <TARGET_IP>:8009;
    keepalive 10;
}

server {
    listen 80;
    location / {
        ajp_keep_conn on;
        ajp_pass tomcats;
    }
}
```

3. **Start Nginx:**

```bash
sudo nginx
# Test with
curl http://127.0.0.1
```

### Option 2: Dockerized Nginx AJP Proxy

Quick setup using Docker:

```bash
git clone https://github.com/ScribblerCoder/nginx-ajp-docker
cd nginx-ajp-docker

# Edit nginx.conf and replace TARGET-IP with your target
docker build . -t nginx-ajp-proxy
docker run -it --rm -p 80:80 nginx-ajp-proxy
```

### Option 3: Apache AJP Proxy

Apache can also serve as an AJP proxy using the `mod_ajp` module. Configure similarly to Nginx but with Apache's configuration syntax.

## Common Attack Scenarios

### 1. Access Tomcat Manager

If AJP is exposed and Tomcat Manager is accessible:

1. Set up AJP proxy (Nginx or Docker)
2. Access `http://127.0.0.1/manager/html`
3. Brute force credentials if needed
4. Deploy malicious WAR files for RCE

### 2. File Disclosure via Ghostcat

1. Identify vulnerable Tomcat version
2. Use Ghostcat exploit to read `WEB-INF/web.xml`
3. Extract credentials from configuration
4. Pivot to other services

### 3. Information Gathering

1. Enumerate AJP with nmap scripts
2. Extract server headers and methods
3. Identify Tomcat version
4. Check for known vulnerabilities

## Safety and Ethics

- Only test systems you have explicit authorization to pentest
- AJP exploitation can lead to full system compromise
- Document all findings and report vulnerabilities responsibly
- Be aware that accessing AJP ports may trigger IDS/IPS alerts

## References

- [8009 - The Forgotten Tomcat Port](https://diablohorn.com/2011/10/19/8009-the-forgotten-tomcat-port/)
- [Ghostcat Vulnerability](https://www.chaitin.cn/en/ghostcat)
- [Exploit-DB #48143](https://www.exploit-db.com/exploits/48143)
- [Nginx AJP Module](https://github.com/yaoweibin/nginx_ajp_module)
- [Nginx AJP Docker](https://github.com/ScribblerCoder/nginx-ajp-docker)