SAP Direct Browsing URLs for Pentesting

List of SAP HTTP Resources to hack at…

/rep/build_info.html

/rep/build_info.jsp

/run/build_info.html

/run/build_info.jsp

/rwb/version.html

/sap/bc/bsp/esh_os_service/favicon.gif

/sap/bc/bsp/sap

/sap/bc/bsp/sap/alertinbox

/sap/bc/bsp/sap/bsp_dlc_frcmp

/sap/bc/bsp/sap/bsp_veri

/sap/bc/bsp/sap/bsp_verificatio

/sap/bc/bsp/sap/bsp_wd_base

/sap/bc/bsp/sap/bspwd_basics

/sap/bc/bsp/sap/certmap

/sap/bc/bsp/sap/certreq

/sap/bc/bsp/sap/crm_bsp_frame

/sap/bc/bsp/sap/crmcmp_bpident/

/sap/bc/bsp/sap/crmcmp_brfcase

/sap/bc/bsp/sap/crmcmp_hdr

/sap/bc/bsp/sap/crmcmp_hdr_std

/sap/bc/bsp/sap/crmcmp_ic_frame

/sap/bc/bsp/sap/crm_thtmlb_util

/sap/bc/bsp/sap/crm_ui_frame

/sap/bc/bsp/sap/crm_ui_start

/sap/bc/bsp/sap/esh_sap_link

/sap/bc/bsp/sap/esh_sapgui_exe

/sap/bc/bsp/sap/graph_bsp_test

/sap/bc/bsp/sap/graph_bsp_test/Mimes

/sap/bc/bsp/sap/gsbirp

/sap/bc/bsp/sap/htmlb_samples

/sap/bc/bsp/sap/iccmp_bp_cnfirm

/sap/bc/bsp/sap/iccmp_hdr_cntnr

/sap/bc/bsp/sap/iccmp_hdr_cntnt

/sap/bc/bsp/sap/iccmp_header

/sap/bc/bsp/sap/iccmp_ssc_ll/

/sap/bc/bsp/sap/ic_frw_notify

/sap/bc/bsp/sap/it00

/sap/bc/bsp/sap/public/bc

/sap/bc/bsp/sap/public/graphics

/sap/bc/bsp/sap/sam_demo

/sap/bc/bsp/sap/sam_notifying

/sap/bc/bsp/sap/sam_sess_queue

/sap/bc/bsp/sap/sbspext_htmlb

/sap/bc/bsp/sap/sbspext_xhtmlb

/sap/bc/bsp/sap/spi_admin

/sap/bc/bsp/sap/spi_monitor

/sap/bc/bsp/sap/sxms_alertrules

/sap/bc/bsp/sap/system

/sap/bc/bsp/sap/thtmlb_scripts

/sap/bc/bsp/sap/thtmlb_styles

/sap/bc/bsp/sap/uicmp_ltx

/sap/bc/bsp/sap/xmb_bsp_log

/sap/bc/contentserver

/sap/bc/echo

/sap/bc/error

/sap/bc/FormToRfc

/sap/bc/graphics/net

/sap/bc/gui/sap/its/CERTREQ

/sap/bc/gui/sap/its/designs

/sap/bc/gui/sap/its/webgui

/sap/bc/IDoc_XML

/sap/bc/ping

/sap/bc/report

/sap/bc/soap/ici

/sap/bc/soap/rfc

/sap/bc/srt/IDoc

/sap/bc/wdvd

/sap/bc/webdynpro/sap/apb_launchpad

/sap/bc/webdynpro/sap/apb_launchpad_nwbc

/sap/bc/webdynpro/sap/apb_lpd_light_start

/sap/bc/webdynpro/sap/apb_lpd_start_url

/sap/bc/webdynpro/sap/application_exit

/sap/bc/webdynpro/sap/appl_log_trc_viewer

/sap/bc/webdynpro/sap/appl_soap_management

/sap/bc/webdynpro/sap/ccmsbi_wast_extr_testenv

/sap/bc/webdynpro/sap/cnp_light_test

/sap/bc/webdynpro/sap/configure_application

/sap/bc/webdynpro/sap/configure_component

/sap/bc/webdynpro/sap/esh_search_results.ui

/sap/bc/webdynpro/sap/esh_adm_smoketest_ui

/sap/bc/webdynpro/sap/sh_adm_smoketest_files

/sap/bc/webdynpro/sap/esh_eng_modelling

/sap/bc/webdynpro/sap/esh_admin_ui_component

/sap/bc/webdynpro/sap/wdhc_application

/sap/bc/webdynpro/sap/wd_analyze_config_appl

/sap/bc/webdynpro/sap/wd_analyze_config_comp

/sap/bc/webdynpro/sap/wd_analyze_config_user

/sap/bc/webdynpro/sap/WDR_TEST_ADOBE

/sap/bc/webdynpro/sap/WDR_TEST_EVENTS

/sap/bc/webdynpro/sap/wdr_test_popups_rt

/sap/bc/webdynpro/sap/WDR_TEST_TABLE

/sap/bc/webdynpro/sap/wdr_test_ui_elements

/sap/bc/webdynpro/sap/WDR_TEST_WINDOW_ERROR

/sap/bc/webrfc

/sap/bc/xrfc

/sap/bc/xrfc_test

/sap/es/cockpit

/sap/es/getdocument

/sap/es/opensearch

/sap/es/opensearch/description

/sap/es/opensearch/list

/sap/es/opensearch/search

/sap/es/saplink

/sap/es/search

/sap/es/redirect

/sap/crm

/sap/public/bc

/sap/public/bc/icons

/sap/public/bc/icons_rtl

/sap/public/bc/its/mimes

/sap/public/bc/its/mimes/system/SL/page/hourglass.html

/sap/public/bc/its/mobile/itsmobile00

/sap/public/bc/its/mobile/itsmobile01

/sap/public/bc/its/mobile/rfid

/sap/public/bc/its/mobile/start

/sap/public/bc/its/mobile/test

/sap/public/bc/NWDEMO_MODEL

/sap/public/bc/NW_ESH_TST_AUTO

/sap/public/bc/pictograms

/sap/public/bc/sicf_login_run

/sap/public/bc/trex

/sap/public/bc/ur

/sap/public/bc/wdtracetool

/sap/public/bc/webdynpro/adobechallenge

/sap/public/bc/webdynpro/mimes

/sap/public/bc/webdynpro/ssr

/sap/public/bc/webdynpro/viewdesigner

/sap/public/bc/webicons

/sap/public/bc/workflow

/sap/public/bc/workflow/shortcut

/sap/public/bsp/sap

/sap/public/bsp/sap/htmlb

/sap/public/bsp/sap/public

/sap/public/bsp/sap/public/bc

/sap/public/bsp/sap/public/faa

/sap/public/bsp/sap/public/graphics

/sap/public/bsp/sap/public/graphics/jnet_handler

/sap/public/bsp/sap/public/graphics/mimes

/sap/public/bsp/sap/system

/sap/public/bsp/sap/system_public

/sap/public/icf_check

/sap/public/icf_info

/sap/public/icf_info/icr_groups

/sap/public/icf_info/icr_urlprefix

/sap/public/icf_info/logon_groups

/sap/public/icf_info/urlprefix

/sap/public/icman

/sap/public/info

/sap/public/myssocntl

/sap/public/ping

/sap/webcuif