Finding Apache Tomcat Servers in Your Network

This blog post recounts the Equifax breach tied to an Apache Struts vulnerability and uses it to warn about common insecure defaults; it demonstrates how to find potentially unprotected Apache Tomcat servers using Censys search queries, recommends remediation steps (identify owner, take offline if unused, harden or replace, educate staff), and suggests additional searches for exposed databases and services.