1

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are the implications of having this directory available publicly and how harmful can it be?

enter image description here

enter image description here

enter image description here

  • Those two contexts are access without authen, attacker can leverage them to perform DoS attack. – elsadek May 11 '16 at 17:08
1

This has been documented in the past, where researchers discovered that some of the Tomcat examples left on a default install were vulnerable to exploits. In "vulnerability assessment/auditing" tools/programs, many will flag this directory as being at a high risk due to these applications being left on a system after an installation. A best practice approach to hardening systems is to remove defaults. (Default directories that are not needed, default passwords, change usernames, and so forth.) It is simply an open vector for an attacker to determine more information that can be further used to propagate attacks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.