Tomcat/JBoss .nse script for nmap that also includes a short dictionary attack for Tomcat’s /manager/html basic-auth.
You can download it from the following link: https://packetstormsecurity.com/files/download/97411/tomcat-scan.tar.gz
Source: https://packetstormsecurity.com/files/97411/Tomcat-JBoss-Nmap-Script-Brute-Forcing-Tool.html