lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache Tomcat

Apache Software Foundationother4 credentials

Credentials4 documented
01

Manager / Host Manager User Password

apache-tomcat / manager-user-password

Tomcat Manager and Host Manager authenticate users through a configured Realm. The default UserDatabaseRealm is typically backed by $CATALINA_BASE/conf/tomcat-users.xml, where operators define usernames, passwords, and manager roles.

user definedsecretusername/password

Looks like

pattern
pattern

tomcat-users.xml user entry with Manager or Host Manager role

<user\s+[^>]*username="[^"]+"[^>]*password="[^"]+"[^>]*roles="[^"]*(manager-gui|manager-script|manager-jmx|manager-status|admin-gui|admin-script)[^"]*"[^>]*/?>

Location

config file
$CATALINA_BASE/conf/tomcat-users.xml, /etc/tomcat/tomcat-users.xml, /usr/local/tomcat/conf/tomcat-users.xml, /opt/tomcat/conf/tomcat-users.xml

Tomcat user database files containing username/password/role entries

config file
$CATALINA_BASE/conf/server.xml, /etc/tomcat/server.xml, /usr/local/tomcat/conf/server.xml, /opt/tomcat/conf/server.xml

Realm configuration can point authentication at XML, JDBC, JNDI, JAAS, or custom stores

config file
%CATALINA_BASE%\conf\tomcat-users.xml, C:\Program Files\Apache Software Foundation\Tomcat\conf\tomcat-users.xml

Windows Tomcat user database files

public interface
/manager/html, /manager/text, /manager/jmxproxy, /host-manager/html
secret store

Deployment vaults, Kubernetes Secrets, CI/CD variables, and password managers

source code

Dockerfiles, lab compose files, deployment examples, golden Tomcat configs

artifact

WAR deployment bundles, config backups, AMI/container build artifacts

logs

Manager authentication logs, access logs, and deployment traces

Notes

Tomcat documentation states no username in the default users file is assigned Manager roles, so Manager access is disabled by default. Do not treat example users as shipped defaults.

02

Realm User Password

apache-tomcat / realm-user-password

Tomcat web applications using container-managed security authenticate users through a Realm. Realms may store usernames, passwords, and roles in tomcat-users.xml, a database, LDAP/JNDI, JAAS, or a custom backend.

user definedsecretusername/password

Looks like

pattern
pattern

tomcat-users.xml user entry for MemoryRealm or UserDatabaseRealm

<user\s+[^>]*username="[^"]+"[^>]*password="[^"]+"[^>]*roles="[^"]*"[^>]*/?>

Location

config file
$CATALINA_BASE/conf/tomcat-users.xml, /etc/tomcat/tomcat-users.xml, /usr/local/tomcat/conf/tomcat-users.xml, /opt/tomcat/conf/tomcat-users.xml

Tomcat XML user database files

config file
$CATALINA_BASE/conf/server.xml, /etc/tomcat/server.xml, /usr/local/tomcat/conf/server.xml, /opt/tomcat/conf/server.xml

Realm, DataSourceRealm, JDBCRealm, JNDIRealm, and JAASRealm configuration

config file
META-INF/context.xml, WEB-INF/web.xml, context.xml

Web application security constraints and context-level Realm/configuration

database

JDBCRealm or DataSourceRealm user and role tables

public interface

Application login forms protected by Servlet security constraints

secret store

Password managers, LDAP bind stores, JNDI secrets, and deployment secret stores

source code

context.xml, web.xml, test fixtures, deployment templates

Notes

Realm password storage depends on the configured Realm and digest settings.

03

JNDI DataSource Credential

apache-tomcat / datasource-credential

Tomcat commonly defines JDBC resources in server.xml or context.xml with username and password attributes for application database access.

user definedsecretusername/password

Looks like

pattern
pattern

Tomcat JNDI Resource/DataSource with username and password attributes

<Resource\s+[^>]*(username|user)="[^"]+"[^>]*password="[^"]+"[^>]*/?>

Location

config file
$CATALINA_BASE/conf/server.xml, /etc/tomcat/server.xml, /usr/local/tomcat/conf/server.xml, /opt/tomcat/conf/server.xml

Global JNDI resource and datasource definitions

config file
META-INF/context.xml, context.xml

Application context JNDI Resource/DataSource definitions

secret store

Deployment vaults, Kubernetes Secrets, and externalized datasource password stores

source code

Application context files, deployment descriptors, and test fixtures

logs

JDBC connection errors, deployment logs, and support bundles

04

TLS Keystore / Private Key Password

apache-tomcat / tls-keystore-password

Tomcat HTTPS connectors can reference keystores, truststores, certificates, private keys, and passwords in server.xml.

user definedgenerated on installsecretpassword

Looks like

pattern
pattern

Tomcat Connector TLS keystore/private-key password attribute

(?:keystorePass|certificateKeyPassword|truststorePass)="[^"]{1,255}"

Location

config file
$CATALINA_BASE/conf/server.xml, /etc/tomcat/server.xml, /usr/local/tomcat/conf/server.xml, /opt/tomcat/conf/server.xml

HTTPS Connector TLS key/trust store configuration

config file
%CATALINA_BASE%\conf\server.xml, C:\Program Files\Apache Software Foundation\Tomcat\conf\server.xml

Windows Tomcat TLS Connector configuration

secret store

Java keystores, certificate vaults, Kubernetes Secrets, and deployment secret stores

artifact

Config backups, support bundles, and container images

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.