Metasploit Tomcat Manager Login Scanner

Metasploit auxiliary module that checks HTTP authentication against a Tomcat Manager endpoint and reports successful or failed credentials. Before candidate checks, it probes the Manager path with a generated username. It does not exploit Tomcat or upload a WAR. The module exposes username/password inputs plus default user, password, and user/password files, so unconstrained use can make repeated guesses and trigger account lockouts. ATT&CK T1110.001 applies only when multiple candidate passwords are tried.