Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are the implications of having this directory available publicly and how harmful can it be?
This has been documented in the past, where researchers discovered that some of the Tomcat examples left on a default install were vulnerable to exploits. In "vulnerability assessment/auditing" tools/programs, many will flag this directory as being at a high risk due to these applications being left on a system after an installation. A best practice approach to hardening systems is to remove defaults. (Default directories that are not needed, default passwords, change usernames, and so forth.) It is simply an open vector for an attacker to determine more information that can be further used to propagate attacks.
