AJP / Ghostcat (CVE-2020-1938)

You are helping a penetration tester exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938). AJP is a binary protocol used for communication between a front-end web server and Tomcat. When the AJP connector is exposed (typically port 8009), it enables arbitrary file read from the webapp directory and, with a file upload primitive, remote code execution. All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [ajp-ghostcat] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).

Scope Boundary