Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: local policy)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Apple Message framework v1280)
Subject: Re: exploting tomcat vulnerability with example
From: Daniel Mikusa <dmikusa@vmware.com>
In-Reply-To: <50598A17.5030205@gmail.com>
Date: Wed, 19 Sep 2012 08:19:36 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <8101CC66-08E6-418A-B7CC-D5E344C91C7E@vmware.com>
References: <50598A17.5030205@gmail.com>
To: "Tomcat Users List" <users@tomcat.apache.org>

On Sep 19, 2012, at 5:02 AM, Ragini wrote:

> Hi all,
>=20
> For my research work I want to have different attacking scenarios =
which exploits vulnerability of JAVA based applications. This java =
applications can be just any web-application, desktopapplication or any =
other.
>=20
> For this, I was thinking to exploit vulnerabilities of tomcat itself =
(because it is in java). I went through different vulnerabilities of =
different versions of tomcat on apache tomcat's official site. They have =
provided information about what is the vulnerability and what is its =
consequences.
>=20
> But I am looking for some real time example by which I can exhibit the =
exploitation of tomcat=92s vulnerability. The version of the tomcat can =
be just any. I would like to try vulnerabilities like authentication =
bypass, information disclosure or some other which really compromises =
the security.

Try looking at Metasploit. =20

Dan


> Could anybody please suggest some source where I can get step by step =
information about exploiting tomcat=92s vulnerability with example ? It =
would be nice if the example web application used for exploitation is =
also in java.
>=20
> I would really appreciate your any kind of help regarding this.
>=20
> Thanks.
>=20
> Richa.
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org