本文共 1066 字，大约阅读时间需要 3 分钟。

Several (tm) months back I did my talk on "From LOW to PWNED" at  and .

The slides were published  and the video from hashdays is , no video for BSides ATL. I consistently violate  and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway. Post [3] JBoss/Tomcat server-status There have been some posts/exploits/modules on hitting up unprotected jboss and tomcat servers.             Sometimes even though the deployer functionality is password protected the sever-status may not be. /web-console/status?full=true

/manager/status/all



LOW?

This can be useful to find:

• Lists of applications
• Recent URL's accessed
  • sometimes with sessionids 
• Find hidden services/apps
• Enabled servlets
• owned stuff :-)

转载地址：http://nvhmb.baihongyu.com/