Joomscan

Description

Official page: https://wiki.owasp.org/index.php/Category:OWASP_Joomla_Vulnerability_Scanner_Project

OWASP Joomla! Vulnerability Scanner (JoomScan) is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. Implemented in Perl, this tool enables seamless and effortless scanning of Joomla installations, while leaving a minimal footprint with its lightweight and modular architecture. It not only detects known offensive vulnerabilities, but also is able to detect many misconfigurations and admin-level shortcomings that can be exploited by adversaries to compromise the system. Furthermore, OWASP JoomScan provides a user-friendly interface and compiles the final reports in both text and HTML formats for ease of use and minimization of reporting overheads. OWASP JoomScan is included in Kali Linux distributions.

Installation

$ git clone https://github.com/rezasp/joomscan.git
$ cd joomscan
$ perl joomscan.pl

Usage

Syntax

Usage: joomscan.pl [options]

Options

--url | -u <URL>

The Joomla URL/domain to scan.

--enumerate-components | -ec

Try to enumerate components.

--cookie <String>

Set cookie.

--user-agent | -a <user-agent>

Use the specified User-Agent.

--random-agent | -r

Use a random User-Agent.

--timeout <time-out>

set timeout.

--about

About Author

--update

Update to the latest version.

--help | -h

This help screen.

--version

Output the current version and exit.

Examples

Do default checks

$ perl joomscan.pl --url www.example.com

Enumerate installed components

$ perl joomscan.pl --url www.example.com --enumerate-components

Set cookie

$ perl joomscan.pl --url www.example.com --cookie "test=demo;" 

Set user-agent

$ perl joomscan.pl --url www.example.com --user-agent "Googlebot/2.1 (+http://www.googlebot.com/bot.html)" 

Set random user-agent

$ perl joomscan.pl -u www.example.com --random-agent

Set proxy

$ perl joomscan.pl --url www.example.com --proxy http://127.0.0.1:8080

Update Joomscan

$ perl joomscan.pl --update