lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Adobe Experience Manager

Adobeother6 credentials1 default credential

Credentials6 documented
01

Default Administrator Account

adobe-experience-manager / default-admin

AEM quickstart installations include the built-in admin account used for initial author/publish administration. Adobe hardening guidance calls out changing default passwords for the AEM admin and OSGi Web Console admin accounts after installation.

static defaultuser definedsecretusername/password

Default credentials

admin:admin

Location

public interface
/libs/granite/core/content/login.html, /crx/de/index.jsp, /system/console, /crx/packmgr/index.jsp, /bin/receive

AEM author/publish login, CRXDE Lite, Felix console, Package Manager, and replication receiver contexts

config file
quickstart.properties, start.bat, start.sh, crx-quickstart/conf/controlport, crx-quickstart/repository/repository.xml

Product-owned quickstart/startup and repository files that may expose default admin use or bootstrap context

database

JCR/Oak repository user and token nodes

artifact

AEM package exports, repository backups, and quickstart snapshots

logs

request.log, audit logs, error.log, access logs, and authentication traces containing default-admin activity

Notes

admin/admin is an initial/development credential. Adobe recommends changing both the AEM admin and OSGi Web Console admin passwords after installation.

02

Repository / Service User Password

adobe-experience-manager / repository-user-password

AEM stores local repository users, service users, and application accounts in the JCR/Oak repository for authoring, replication, package management, and integrations.

user definedgenerated on installsecretusername/password

Location

public interface
/libs/granite/security/content/useradmin.html, /crx/de/index.jsp, /crx/packmgr/index.jsp, /bin/receive

AEM user administration, CRXDE, package manager, and replication endpoints

config file
jcr_root/home/users/.content.xml, jcr_root/home/users/system/.content.xml, jcr_root/home/groups/.content.xml, crx-quickstart/repository/repository.xml

Content package and repository files that can contain user/service-user nodes, password hashes, and auth metadata

database

JCR/Oak repository users, groups, rep:password hashes, token nodes, and service user mappings

secret store

Password vaults, Cloud Manager variables, deployment secrets, and enterprise secret stores

source code

Content packages, repoinit scripts, tests, runmode configs, and provisioning repositories

logs

request.log, audit logs, error.log, and authentication traces

Notes

Repository password material is usually stored as hashes or protected values; detect this surface by AEM repository/package context rather than generic password words.

03

Replication Agent Transport Credential

adobe-experience-manager / replication-agent-credential

AEM replication agents can use transport credentials to authenticate from author to publish or dispatcher endpoints. Adobe hardening guidance says the default admin user should not be used for replication transport credentials.

user definedsecretusername/password

Looks like

pattern
pattern

Contextual replication-agent transport credential or encrypted password in exported repository/config content

(?i)(transportUser|transportPassword|transportUri|replication)[A-Za-z0-9_ .:/-]{0,80}(password|admin|\{[A-Za-z0-9+/=]{20,}\})

Location

public interface
/etc/replication/agents.author.html, /etc/replication/agents.publish.html, /bin/receive, /dispatcher/invalidate.cache

Replication agent consoles, receiver servlet, and dispatcher flush contexts

config file
jcr_root/etc/replication/agents.author/publish/jcr:content/.content.xml, jcr_root/etc/replication/agents.author/flush/jcr:content/.content.xml, jcr_root/etc/replication/agents.publish/flush/jcr:content/.content.xml

Common AEM content-package paths for replication agent configuration exports

database

JCR replication agent nodes and protected properties

secret store

AEM Crypto Support, Cloud Manager variables, Kubernetes Secrets, and vaults

source code

Content packages, runmode configs, deployment repositories, and dispatcher automation

logs

Replication logs, dispatcher flush logs, request logs, and transport debug traces

04

OSGi, Crypto Support, and Integration Secrets

adobe-experience-manager / osgi-and-crypto-secrets

AEM OSGi configurations can hold SMTP passwords, LDAP bind credentials, dispatcher flush secrets, OAuth/client secrets, database credentials, replication agent passwords, and Crypto Support encrypted values. AEM 6.3+ stores Crypto Support HMAC and master files under the com.adobe.granite.crypto.file bundle data directory.

generated on installuser definedsecretsecret value

Looks like

pattern
pattern

Contextual AEM encrypted OSGi configuration value produced by Crypto Support

(?i)(password|secret|token|credential|clientSecret|bindPassword|transportPassword|smtpPassword)[A-Za-z0-9_ .:/-]{0,40}[:=]\s*\{[A-Za-z0-9+/=]{20,}\}

Location

config file
crx-quickstart/launchpad/config/org/apache/felix/webconsole/internal/servlet/OsgiManager.config, crx-quickstart/repository/repository.xml, crx-quickstart/conf/controlport

Product-owned OSGi/web-console, repository, and quickstart configuration files

config file
org.apache.felix.webconsole.internal.servlet.OsgiManager.config, com.day.cq.mailer.DefaultMailService.config, org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider.config, com.adobe.granite.auth.saml.SamlAuthenticationHandler.config

Project/runmode OSGi configuration filenames that commonly hold admin, SMTP, LDAP, SAML, or integration secrets

database

JCR configuration nodes for OSGi configs, replication agents, and integration credentials

secret store

AEM Crypto Support master/HMAC files, Cloud Manager secrets, Kubernetes Secrets, and vaults

source code

Committed OSGi config files, content packages, runmode folders, and deployment repos

logs

Replication, LDAP, SAML, mail, and connector debug logs

Notes

Adobe documents copying the HMAC and master files from the com.adobe.granite.crypto.file bundle data directory, but the Felix bundle number is instance-specific. It is therefore kept as secret-store context rather than a globbed CredsHound path.

05

Login Token / OAuth Token

adobe-experience-manager / api-session-token

AEM issues login tokens and may store OAuth/access tokens for integrations with Adobe and third-party services.

generated on installuser definedsecrettoken

Location

http header
Cookie

AEM login-token and session cookies

http header
Authorization

Bearer/OAuth tokens used by integrations and Sling clients

config file
jcr_root/home/users/.content.xml, jcr_root/home/users/system/.content.xml, crx-quickstart/repository/repository.xml

Repository/package paths that may contain token nodes or token-related auth metadata

database

JCR token nodes and OAuth/client credential storage

logs

HTTP traces, request logs, access logs, and client debug output

06

Truststore / Keystore Secret

adobe-experience-manager / truststore-or-keystore-secret

AEM deployments use keystores, truststores, SSL certificates, and private keys for HTTPS, SAML, LDAP over TLS, and integrations.

user definedgenerated on installsecretkey pair

Looks like

pattern
pattern

Private-key header when AEM packages, configs, backups, or integrations expose key material

-----BEGIN (RSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----

Location

config file
quickstart.properties, crx-quickstart/repository/repository.xml, org.apache.felix.https.config, com.adobe.granite.auth.saml.SamlAuthenticationHandler.config

Product-owned or runmode config files that may reference HTTPS/SAML/LDAP key and truststore material

database

JCR truststore, keystore, and certificate nodes

secret store

Java keystores, AEM truststore/keystore secrets, Cloud Manager variables, and vaults

artifact

AEM backups, content packages, support bundles, and deployment archives

logs

TLS, SAML, LDAP, and startup troubleshooting logs

Notes

Generic keystore filenames and generic private-key paths are intentionally not repeated as scanner paths. Include only AEM-owned config/package context here.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.