The file and directory structure of Tomcat is similar to that of JBoss, which we discussed in the previous chapter. In this section, we will quickly go through the directory structure of Tomcat, shown in the following screenshot:

The subdirectories in the Tomcat directory can be explained as follows:

• bin: This directory contains all of the scripts that are required when a server is initialized, such as startup and shutdown scripts and executables.

• common: This directory contains common classes that Catalina and other web applications hosted by the developer can use.

• conf: This directory consists of server XML files and related Document Type Definitions (DTDs) to configure Tomcat.

• logs: This directory, as the name suggests, stores logs generated by Catalina and applications.

• server: This directory stores classes that are used solely by Catalina.

• shared: This directory stores classes that can be shared by all web applications.

• webapps: This directory contains all the web applications.

• work: This directory represents temporary storage for files and directories.

One of the most interesting directories is the webapps directory:

By navigating to the webapps directory and listing the contents, we can take a look at the directories, as in the preceding screenshot:

• ROOT: This is the web application's root directory. It contains all the JSP files and HTML pages, client-side JAR files, and more.

• docs: This directory contains the Apache Tomcat documentation.

• examples: The examples folder contains servlet, JSP, and WebSocket examples to help developers with development.

• host-manager: The host-manager application lets us create, delete, and manage virtual hosts within Tomcat. This directory contains the code for this.

• manager: manager lets us manage the web applications installed on the Apache Tomcat instance in the form of Web Application Archive (WAR) files.

A clear understanding of the file and directory structures can help us to perform quite an efficient reconnaissance for our penetration tests on the target Tomcat server.