For Teachers · Back to the Module · Print with your browser's Print command.

P13 Teacher Answer Key: Application Servers: Tomcat, Node.js and Python

Teacher Answer Key (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P6

Learning Objectives

• [ ] Explain why application servers belong behind a reverse proxy, bound to loopback.
• [ ] Recognise debuggers and development servers that give remote code execution.
• [ ] Harden the Tomcat Manager, AJP connector and shutdown port, and Django's production settings.

Key Terms

Write each definition in your own words.

• Reverse Proxy: A web server such as nginx or Apache that receives requests from the internet and forwards them to an application server listening on loopback.
• Debug Mode: A development setting that shows internal details such as source code, settings and stack traces, and sometimes allows running code; it must be off in production.
• Default Credentials: User names and passwords that ship with a product or appear in its documentation, which attackers try first.
• End of Life: The date after which a product no longer receives security fixes from its maintainer.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-APP-,WEB-TOM-,WEB-NODE-,WEB-PY- --out p13
2. For each vulnerable service in internal/lab/fixtures_stacks.go, write the corrected ExecStart= and Environment= lines.
3. Read the Tomcat server.xml in both labs and explain what each of the three changes prevents.

Self-Check Questions

1. Why bind Gunicorn to 127.0.0.1:8000 instead of 0.0.0.0:8000?

• [ ] a) It is faster
• [x] b) So every request passes through the hardened reverse proxy
• [ ] c) Gunicorn requires it
• [ ] d) It uses less memory
• Answer: b. Loopback binding keeps the proxy's TLS, headers and slow-client protection in front of the app.

1. What does node --inspect=0.0.0.0:9229 give an attacker who can connect?

• [ ] a) Read-only logs
• [x] b) The ability to run any JavaScript in the application
• [ ] c) Nothing without a password
• [ ] d) A list of running processes only
• Answer: b. The inspector has no authentication.

1. What is the safest fix for an unused Tomcat AJP connector?

• [ ] a) Change its port
• [x] b) Remove or comment out the connector
• [ ] c) Add a firewall rule for port 80
• [ ] d) Bind it to 0.0.0.0 with a secret
• Answer: b. A connector that does not exist cannot be attacked. If it is needed, bind it to loopback with a secret.

1. Which of these is documented as not for production?

• [ ] a) Gunicorn behind nginx
• [x] b) manage.py runserver
• [ ] c) nginx as a reverse proxy
• [ ] d) A systemd service unit
• Answer: b. Django's development server, flask run and python -m http.server are all documented as not for production.

1. Why is the Tomcat Manager application sensitive?

• [x] a) It deploys WAR files, so it is code execution behind a password
• [ ] b) It only shows the Tomcat version
• [ ] c) It only changes the log level
• [ ] d) It serves static files
• Answer: a. Anyone who logs in to the Manager can deploy and run code. Limit it to localhost or remove it.

1. What happens after a Node.js release line reaches end of life?

• [ ] a) It gets security fixes for five more years
• [x] b) There are no more security releases
• [ ] c) It becomes an LTS line
• [ ] d) It is removed from servers automatically
• Answer: b. End of life means no more security releases, so plan upgrades before the date.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Apache Tomcat, Security Considerations: https://tomcat.apache.org/tomcat-10.1-doc/security-howto.html
• Django, Deployment checklist: https://docs.djangoproject.com/en/6.1/howto/deployment/checklist/
• OWASP Node.js Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.