id: aem-detect

info:
  name: Favicon based AEM Detection
  author: shifacyclewala,hackergautam
  severity: info
  reference:
    - https://twitter.com/brsn76945860/status/1171233054951501824
    - https://gist.github.com/yehgdotnet/b9dfc618108d2f05845c4d8e28c5fc6a
    - https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139
    - https://github.com/devanshbatham/FavFreak
    - https://github.com/sansatart/scrapts/blob/master/shodan-favicon-hashes.csv
  classification:
    cpe: cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: adobe
    product: experience_manager
    shodan-query: http.component:"Adobe Experience Manager"
  tags: aem,favicon,tech,adobe,discovery

http:
  - method: GET
    path:
      - "{{BaseURL}}/libs/granite/core/content/login/favicon.ico"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "status_code==200 && (\"-144483185\" == mmh3(base64_py(body)))"
# digest: 4a0a00473045022100cd405398aa759c4f950a80bfc097e625ea9be0082566a28bbc3ac757861c0c8d02204080864bde532a50bc5a572ffac5d31d04c3cc9340d3a49f2ac3fbdc314440fd:922c64590222798bb761d5b6d8e72950