2020-04-21 10:32:32 +00:00
id : jkstatus-manager
info :
2023-02-09 04:55:47 +00:00
name : JK Status Manager - Detect
2023-02-07 21:26:36 +00:00
author : pdteam,DhiyaneshDk
2020-04-21 10:32:32 +00:00
severity : low
2023-12-29 09:53:08 +00:00
description : |
Exposed JKStatus manager which is a web-based tool that allows administrators to monitor and manage the connections between the Apache HTTP Server and the Tomcat application server.
2023-02-07 21:26:36 +00:00
reference :
- https://github.com/PortSwigger/j2ee-scan/blob/master/src/main/java/burp/j2ee/issues/impl/JKStatus.java
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-10-14 11:27:55 +00:00
max-request : 8
2023-02-07 21:26:36 +00:00
shodan-query : html:"JK Status Manager"
2024-09-10 08:22:50 +00:00
product : tomcat
vendor : apache
2023-06-02 23:20:14 +00:00
tags : config,jk,status,exposure
2020-04-21 10:32:32 +00:00
2024-09-10 08:22:50 +00:00
classification :
cpe : cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
2023-04-27 04:28:59 +00:00
http :
2020-04-21 10:32:32 +00:00
- method : GET
2023-10-14 11:27:55 +00:00
2020-04-21 10:32:32 +00:00
headers :
X-Forwarded-For : "127.0.0.1"
2020-05-25 08:02:27 +00:00
path :
2023-02-07 21:26:36 +00:00
- "{{BaseURL}}"
- "{{BaseURL}}/status"
- "{{BaseURL}}/jkstatus"
- "{{BaseURL}}/jkstatus-auth"
- "{{BaseURL}}/jk-status"
- "{{BaseURL}}/jkmanager"
- "{{BaseURL}}/jkmanager-auth"
- "{{BaseURL}}/jdkstatus"
stop-at-first-match : true
2020-04-21 10:32:32 +00:00
matchers :
- type : word
2020-05-25 08:02:27 +00:00
words :
2023-02-07 21:26:36 +00:00
- "JK Status Manager"
2024-09-10 08:22:50 +00:00
# digest: 490a0046304402205bc0be4fe64354ab625e609d9b1de733811c19aee5c839064f3ee13fe5f1a9d702206e4a116fd9cd36ff0920b8589a6fdbb374ed0d8537cfeaf33faf2e63d21f1d3a:922c64590222798bb761d5b6d8e72950
