💻
Secure Code Review Fundamentals
  • Start Here
  • Java
    • Common Sinks
    • Gadget Hunting
    • JRMP
    • Spring [todo]
    • JPA [todo]
    • JDBC [todo]
    • RMI [todo]
    • JNDI [todo]
    • Servlets [todo]
    • Tomcat [todo]
    • JavaServer Faces [todo]
    • JBoss [todo]
    • JavaBean
    • Remote Debugging Tomcat Web Applications
    • Expression Language
      • CVE-2020-9297
      • Exploitation
  • PHP
    • Classic Deserialization (POP) [todo]
    • Common Sinks [todo]
    • PHAR Deserialization [todo]
  • Ruby
    • Common Sinks
    • YAML deserialization [todo]
    • Rails Active Record SQL Injection
  • Python
    • Common Sinks
    • YAML deserialization [todo]
  • Tools
    • CodeQL [todo]
  • Code Review Fundamentals
    • Techniques
  • Untitled
  • CodeQL
    • Common Classes [Java]
    • Useful Classes [Java]
    • Compiling Databases
  • Semgrep
    • About
    • Real World Examples
      • Java == String Equality
Powered by GitBook
On this page

Was this helpful?

  1. Java

Tomcat [todo]

PreviousServlets [todo]NextJavaServer Faces [todo]

Last updated 3 years ago

Was this helpful?

take notes from AWAE in how JSP derived servlets are recompiled when change is detected (if tomcat is development mode)

mention tomcat path traversal via reverse proxy mapping

LogoAn introduction to Tomcat servlet interactions | MuleSoftMuleSoft
https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf