Att: alycia
Just now I did a very simple 'test' on that server, I found the directory listing is on. The interesting directories are :
/admin/
/server-status/
/server-info/

Both the server-* directories are only information disclosure vulnerabilites.
But the /admin/.. hmm.. looks interesting.

To do a complete pen-test, needs a lot of time, there's no a single silver bullet to 'hack'.

Last week, I found that the application is vulnerable to cookie-session injection attack. I told abg mazani, and give him the proper solution.