> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/pentesting-process/web-attacks/ajp.md).

# AJP

Apache JServ Protocol.

[Apache JServ Protocol](https://cwiki.apache.org/confluence/display/TOMCAT/Connectors) is a network protocol used for communication between a web server and a web application or app server. Since it is a binary protocol, we need to configure our Nginx or Apache web server with AJP modules to interact with it and access the underlying application in order to discover administrative panels, applications, and Web sites that would otherwise be inaccessible (of course if the victim server is not configured correctly and is open).

AJP proxy ports : **`8009 TCP`**

## Nginx Reverse Proxy Setting with ajp\_module

Use Nginx with ajp\_module to access the “hidden” Tomcat Manager.

Download the source code of Nginx

{% code overflow="wrap" %}

```bash
wget https://nginx.org/download/nginx-1.21.3.tar.gz
tar -xzvf nginx-1.21.3.tar.gz
```

{% endcode %}

Download the required module

{% code overflow="wrap" %}

```bash
git clone https://github.com/dvershinin/nginx_ajp_module.git
```

{% endcode %}

Compile Nginx source code with ajp\_module extension

{% code overflow="wrap" %}

```bash
cd nginx-1.21.3
sudo apt install libpcre3-dev
./configure --add-module=`pwd`/../nginx_ajp_module --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules
make
sudo make install
nginx -V
```

{% endcode %}

Creates a configuration file that pointing to the AJP port

{% code overflow="wrap" %}

```bash
# in /etc/nginx/conf/nginx.conf replace block http{ ... server{ ... with: 

upstream tomcats {
	server <TARGET_SERVER>:8009;
	keepalive 10;
	}
server {
	listen 80;
	location / {
		ajp_keep_conn on;
		ajp_pass tomcats;
	}
}
```

{% endcode %}

Starting and sending request (should connect to tomcat)

{% code overflow="wrap" %}

```bash
sudo nginx
curl http://127.0.0.1:80
```

{% endcode %}

Close

{% code overflow="wrap" %}

```bash
sudo nginx -s stop
```

{% endcode %}

## Apache Reverse Proxy Setting with AJP Module

If you want to change the port on which to run Apache, you need to edit in `/etc/apache2/ports.conf`.

Install the package `libapache2-mod-jk`

{% code overflow="wrap" %}

```bash
sudo apt install libapache2-mod-jk
```

{% endcode %}

Enable the module

{% code overflow="wrap" %}

```bash
sudo a2enmod proxy_ajp
sudo a2enmod proxy_http
```

{% endcode %}

Create a configuration file that pointing to the target AJP-Proxy port

{% code overflow="wrap" %}

```bash
export TARGET="<TARGET_IP>"
echo -n """<Proxy *>
Order allow,deny
Allow from all
</Proxy>
ProxyPass / ajp://$TARGET:8009/
ProxyPassReverse / ajp://$TARGET:8009/""" | sudo tee /etc/apache2/sites-available/ajp-proxy.conf
sudo ln -s /etc/apache2/sites-available/ajp-proxy.conf /etc/apache2/sites-enabled/ajp-proxy.conf
```

{% endcode %}

Starting and sending request (should connect)

{% code overflow="wrap" %}

```bash
sudo systemctl start apache2
curl http://127.0.0.1:80
```

{% endcode %}

Close

{% code overflow="wrap" %}

```bash
sudo systemctl stop apache2
```

{% endcode %}