logo

Port 8180 – Web Admin / Alternate HTTP

Service:

Tomcat ,
WildFly ,
JBoss ,
custom dashboards

Protocol:

TCP

Port:

8180

Used for:

Alternate HTTP interface, often used for web consoles or application backends

Why It’s Open

Similar to 8080, port 8180 is used for alternate web applications — particularly Java-based servers like Tomcat or JBoss in dev/staging setups.

Common Risks

  • Tomcat Manager Interface: Known for default creds (tomcat:tomcat).
  • Deserialization Vulnerabilities: Especially in Java-based apps.
  • No Auth or Auth Bypass: Many apps running on 8180 are under-secured.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Port check

Terminal window
nmap -p 8180 -sV


curl http://:8180
nmap -p 8180 --script http-title,http-auth

What to Look For

CheckpointWhat it means
Exposed management UICould allow remote admin
Default or weak credsRisk of full compromise
Debug endpointsMay lead to RCE or info leaks

Known Exploits

  1. CVE-2017-12615 When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled, it was possible to upload a JSP file to the server via a specially crafted request, leading to remote code execution.

🔗 NVD Entry

Mitigation

  • Disable default web apps (e.g., Tomcat Manager).
  • Change or disable default credentials.
  • Use HTTPS and IP whitelisting.
  • Regularly patch app servers.

Real-World Example

The infamous Jenkins and Tomcat breaches often occurred via exposed web interfaces on ports like 8180 — with attackers uploading webshells or executing arbitrary code.

TL;DR

  • Service: Apache Tomcat (Application Server)
  • Default Port: 8180
  • Risks: Remote code execution via file upload
  • Mitigation: Disable HTTP PUT, update Tomcat, restrict access