The Complete Ethical Hacking Bootcamp: Beginner To Advanced - Exploiting Apache Tomcat with Metasploit

This tutorial demonstrates how to use the Metasploit framework to perform a brute force attack on an Apache Tomcat server. It begins with setting up the Metasploit console and conducting an Nmap scan to identify services. The focus is on using an auxiliary module to brute force the Tomcat server running on port 8080. The tutorial covers configuring options for the attack, executing it, and verifying success by logging into the Tomcat web application manager. The video concludes with a brief overview of future topics, including more advanced exploits.

What is the purpose of using nmap in the initial setup?

• To configure the network settings

• To update the virtual machine

• To identify available services on the virtual machine

• To install Metasploit

Which port is the Apache Tomcat server running on?

• 22

• 443

• 8080

• 80

What is the main function of the auxiliary module used in this tutorial?

• To update Metasploit

• To scan for vulnerabilities

• To install additional plugins

• To brute force the Tomcat server

What is the maximum brute force speed setting allowed?

• 10

• 8

• 5

• 3

Why is it important to set 'stop on success' to true?

• To log all attempts

• To stop brute forcing once credentials are found

• To continue brute forcing after finding credentials

• To increase the speed of the attack

What credentials were successfully used to log into the Tomcat server?

• guest and guest

• admin and password

• root and OWASP BWA

• user and 1234

What will be covered in the next tutorials?

• Configuring network settings

• Exploiting Windows host machines

• Updating the virtual machine

• Installing Metasploit