{"id":13636181,"url":"https://github.com/thomashartm/burp-aem-scanner","last_synced_at":"2025-03-16T15:31:50.669Z","repository":{"id":41440512,"uuid":"163517226","full_name":"thomashartm/burp-aem-scanner","owner":"thomashartm","description":"Burp Scanner extension to fingerprint and actively scan instances of the Adobe Experience Manager CMS. It checks the website for common misconfigurations and security holes.","archived":false,"fork":false,"pushed_at":"2024-03-22T11:31:25.000Z","size":881,"stargazers_count":74,"open_issues_count":8,"forks_count":11,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-10-12T01:09:21.851Z","etag":null,"topics":["adobe-experience-manager","aem","burp","burp-extensions","burp-plugin","dispatcher","java","security-audit","security-automation"],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thomashartm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-29T14:27:02.000Z","updated_at":"2024-09-30T05:08:47.000Z","dependencies_parsed_at":"2024-08-02T00:03:57.958Z","dependency_job_id":"2a7774cb-2d2d-48be-a749-a0ee38294187","html_url":"https://github.com/thomashartm/burp-aem-scanner","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thomashartm%2Fburp-aem-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thomashartm%2Fburp-aem-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thomashartm%2Fburp-aem-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thomashartm%2Fburp-aem-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thomashartm","download_url":"https://codeload.github.com/thomashartm/burp-aem-scanner/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221665463,"owners_count":16860258,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adobe-experience-manager","aem","burp","burp-extensions","burp-plugin","dispatcher","java","security-audit","security-automation"],"created_at":"2024-08-02T00:00:58.221Z","updated_at":"2024-10-27T10:50:41.408Z","avatar_url":"https://github.com/thomashartm.png","language":"Java","funding_links":[],"categories":["Scanners","\u003ca id=\"3d61290c2dab36e7b8e2a1538c60df6b\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"285c52a4e04dd2f86646c8e1235c9332\"\u003e\u003c/a\u003e工具"],"readme":"# Burp AEM Security Scanner Extension\n[![Build Status](https://travis-ci.org/thomashartm/burp-aem-scanner.svg?branch=master)](https://travis-ci.org/thomashartm/burp-aem-scanner)\n\nBurp AEM Security Scanner is an AEM focussed plugin which supports the evaluation of well known misconfigurations of AEM installations.\nIt supports the verification of a number of Adobe's security checklist topics and evaluates typical AEM and Dispatcher misconfigurations. \n\n\n### What is AEM\nAEM is an enterprise grade content management system used by a variety of high profile companies. \nAEM is a powerful but complex system and requires thoughtful handling of defaults and configurations. \nTherefore it leaves room for plenty of security bugs.\n\n## Installation Requirements\nBurp Community is sufficient as the extension does not require the active or passive scanner.\n\n# How to use\nSelect one or multiple pages from within the Target sitemap. Then click on the relevant security check categories which you are planning to execute.\n\nThe scanner extension will use the selected URLs and pass them to the checks. \nEach check is self contained and will decide what to use from the provided URL, e.g. just the host and port e.g. to use it as a base to build the CRX or Felix Console URLs and to test dispatcher bypasses for them or the complete URL e.g. to verify if the particular page is vulnerable for enumeration.\n\n![AEM Actions Menu](https://github.com/thomashartm/burp-aem-scanner/blob/gh-pages/images/aem-actions.jpg \"AEM Actions\")\n\nThe security checks will be executed by a thread pool in the background to check progress, please look into the extender output.\n\n# Why doesn't it use active scanner?\nFirst of all because I want to make the checks available for everyone. \nAdditionally and that is personally my major concern, the Burp extender API does not allow to trigger \"one execution per host\" checks e.g. to test for the existence of CRX and other resources, with the result of many unnecessary requests.\nTherefore I decided to manually trigger those scans.\n\n# How to build and develop\nThe extension is written in java. Please use maven \u003e= 3.3.9 to build it. \nExecute the maven build in the root of the package.\n\n` mvn clean package`\n\nThe compiled and deployable artifact is located in the target directory.\nTo debug the extension, open burp via commandline with remote debugging enabled. \n\n`java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005 -jar burpsuite_pro.jar`\n\n# How to install \nBuild the project.\nThen open Burp extender and select the compiled and assembled JAR.\nThe extender will automatically register the scanner menu including all actions.\nClick a specific action to activate the detection for the provided URL.\n\nOnly the selected URLs will be used as a base for the respective scan.\n\n# Contributions\nIf you have suggestions and ideas for improvement feel free to contact me or just raise a pull request. I'm happy to discuss it.\n\n# Credits\nIt is based on Adobe's AEM/Dispatcher security checklist and implements many of the checks discovered and highlighted by Mikhail Egorov \u003c0ang3el@gmail.com\u003e https://github.com/0ang3el/aem-hacker/blob/master/aem_hacker.py\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthomashartm%2Fburp-aem-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthomashartm%2Fburp-aem-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthomashartm%2Fburp-aem-scanner/lists"}