Using auxiliary/scanner/http/tomcat_mgr_login, I get the following reply after run the exploit command: authorization not requested.

I have set rhosts and my test server is listening on rport 80. Can anyone help me out on this?

  • Please copy/paste and use the code formatting tool to include the actual output. We're giving us only incomplete summaries of what is going on. And this really sounds like a network troubleshooting issue. Can you ping the server? Can you get any connection at all using other means?
    – schroeder
    5 hours ago

1 Answer 1


Run wireshark and check the request/response, it sounds like the response doesn't meet expectations, likely due to the http code or some string matching in the response body. Once you have captured the traffic you can compare it to the metasploit plugin code.

However deploying a shell via war file to tomcat doesn't require the use of metasploit, you can just do it in the browser manually.

Not the answer you're looking for? Browse other questions tagged or ask your own question.