I'm new to this site. I have a question concerning the upload of dynamic java code into an application running on Tomcat 7.0.34.

I'm doing a penetration testing of a java website and found it's possible to upload arbitrary files with a certain upload functionality. I managed to upload an HTML file for example, which then I can access and is rendered adequately. I tried to upload a jsp file, which was possible, but won't be rendered as HTML and the java code in it isn't executed (I get the tags returned in clear text when I request the file). There are certain limitations to the upload as well:

1) I can't choose where to upload the file

2) Files aren't referenced directly. Instead, when the path to the uploaded file is shown, a random URL is created (every time its shown, a different URL is created), like:


3) I don't know the real path where the files are being uploaded or if I can access it directly

Under this circumstances do you think it's somehow possible to inject and execute java code server-side? (I know it would be possible with PHP, but with java and Tomcat I don't know)

Note: I don't have access to the tomcat manager or anything like that.

1 Answer 1


As for the point (2) and for the jsp not rendered correctly, It is likely the uploaded files are stored in a database not in the fs. Otherwise a one reason that jsp are not rendered is because tomacat is having problem locating the tag library.

  • Oh, yeah it seems files are being stored in the database. I'm guessing it won't be possible to execute java code in this context. Commented Nov 1, 2013 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .