Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-tomcat9-v120-10-19The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-tomcat9-v120-10.19 |
| description | Ensure Manager Application Passwords are Encrypted (Manual) |
| category | cis-tomcat |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","tomcat","linux","java","configuration","manager","security","password"] |
| cis_id | 10.19 |
| cis_benchmark | CIS Apache Tomcat 9 Benchmark v1.2.0 |
| tech_stack | ["linux","tomcat","java"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Apache Tomcat ships with a Manager Application which requires users with a role of manager-gui, manager-status, manager-script, and/or manager-jmx to authenticate. The usernames and passwords to log onto the Manager Application are stored in the tomcat-users.xml in plain text by default.
Storing passwords in plain text may allow users with access to read the tomcat-users.xml file to obtain the credentials of user who have been assigned roles for the Manager Application. This may allow for accounts to be compromised on Tomcat and elsewhere.
Perform the following to determine if password digests are in use:
$ grep -i <login-config>|.\n|*<auth-method>DIGEST</auth-method>|.\n] *<realm-
name>UserDatabase</realm-name>:.\n|*</login-config>
$CATALINA_HOME/webapps/manager/WEB-INF/web.xml
If a Realm exists without a digest attribute or without a value for the digest attribute, this is a fail.
cd $CATALINA_HOME/bin
digest.bat -a sha-256 YOURPASSWORD
This will return the original password followed by encrypted password:
YOURPASSWORD:240be518fabd27724db6f04eeb1da5967e31c72a9
c720a9
CATALINA_HOME/conf/tomcat-user.xml file as follows.| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.5 Collect Detailed Audit Logs Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | ● | ● | |
| v7 | 6.3 Enable Detailed Logging Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. |
| ● |
| ● |
Level 1