For Teachers · Back to the Module · Print with your browser's Print command.

P13 Worksheet: Application Servers: Tomcat, Node.js and Python

Student Worksheet (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P6

Learning Objectives

• [ ] Explain why application servers belong behind a reverse proxy, bound to loopback.
• [ ] Recognise debuggers and development servers that give remote code execution.
• [ ] Harden the Tomcat Manager, AJP connector and shutdown port, and Django's production settings.

Key Terms

Write each definition in your own words.

• Reverse Proxy: ______________________________________________
• Debug Mode: ______________________________________________
• Default Credentials: ______________________________________________
• End of Life: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-APP-,WEB-TOM-,WEB-NODE-,WEB-PY- --out p13
2. For each vulnerable service in internal/lab/fixtures_stacks.go, write the corrected ExecStart= and Environment= lines.
3. Read the Tomcat server.xml in both labs and explain what each of the three changes prevents.

Self-Check Questions

1. Why bind Gunicorn to 127.0.0.1:8000 instead of 0.0.0.0:8000?

• [ ] a) It is faster
• [ ] b) So every request passes through the hardened reverse proxy
• [ ] c) Gunicorn requires it
• [ ] d) It uses less memory

1. What does node --inspect=0.0.0.0:9229 give an attacker who can connect?

• [ ] a) Read-only logs
• [ ] b) The ability to run any JavaScript in the application
• [ ] c) Nothing without a password
• [ ] d) A list of running processes only

1. What is the safest fix for an unused Tomcat AJP connector?

• [ ] a) Change its port
• [ ] b) Remove or comment out the connector
• [ ] c) Add a firewall rule for port 80
• [ ] d) Bind it to 0.0.0.0 with a secret

1. Which of these is documented as not for production?

• [ ] a) Gunicorn behind nginx
• [ ] b) manage.py runserver
• [ ] c) nginx as a reverse proxy
• [ ] d) A systemd service unit

1. Why is the Tomcat Manager application sensitive?

• [ ] a) It deploys WAR files, so it is code execution behind a password
• [ ] b) It only shows the Tomcat version
• [ ] c) It only changes the log level
• [ ] d) It serves static files

1. What happens after a Node.js release line reaches end of life?

• [ ] a) It gets security fixes for five more years
• [ ] b) There are no more security releases
• [ ] c) It becomes an LTS line
• [ ] d) It is removed from servers automatically

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• Apache Tomcat, Security Considerations: https://tomcat.apache.org/tomcat-10.1-doc/security-howto.html
• Django, Deployment checklist: https://docs.djangoproject.com/en/6.1/howto/deployment/checklist/
• OWASP Node.js Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.