AEM Dispatcher Security Scan

A commandline tool to perfom an active security scan against a AEM Dispatcher.

This tool tries to unify all known security relevant AEM Dispatcher URLs from the internet.

If you know some more URLs, please open a Github issue to report them.

Usage

Build Docker image

$ make build-docker-image

Run Docker container from built image to print help

$ make run-docker-image

Usage: cli.py [OPTIONS]

  Commandline interface for AEM Dispatcher Security Scan

Options:
  --host TEXT        Set host of website. Leave empty to use default value: http://localhost:8080.  [required]
  --page-path TEXT   Set path of website. Leave empty to use default value: /content/geometrixx/en.
  --timeout INTEGER  Set timeout for http requests in seconds. Leave emtpy to use default value: 10.
  --help             Show this message and exit.

Run Docker container from built image with custom arguments

$ docker compose \
    --file docker-compose.yml \
    run \
    --rm \
    aem-dispatcher-security-scan \
    --host "https://www.adobe.com" \
    --page-path "/content/geometrixx/en"

Development

Build and launch the DevContainer in VSCode.

References

• docs.adobe.com
• 0ang3el/aem-hacker
• emadshanab/Adobe-Experience-Manager
• danielmiessler/seclists
• aem-design/ansible-role-aem-security-test
• cognifide/securecq
• perficientdigital.com
• infosecinstitute.com

License

MIT