JoomScan — CMS Scanners | Tools

Description

JoomScan (OWASP Joomla Vulnerability Scanner) is an automated tool for detecting vulnerabilities in Joomla CMS installations. It checks for known vulnerabilities, misconfigurations, sensitive file exposure, and component-specific flaws.

Installation

                        BASH
                        
                            # Kali (pre-installed)
joomscan -h

# From source
git clone https://github.com/OWASP/joomscan.git
cd joomscan
perl joomscan.pl

Basic Usage

BASH

                            # Scan a Joomla site
perl joomscan.pl -u https://target.com

# With component enumeration
perl joomscan.pl -u https://target.com --ec
                        

Advanced Usage

                        BASH
                        
                            # Custom User-Agent
perl joomscan.pl -u https://target.com -a "Mozilla/5.0"

# Cookie
perl joomscan.pl -u https://target.com --cookie "session=abc123"

# Random User-Agent
perl joomscan.pl -u https://target.com -r

# Output to file
perl joomscan.pl -u https://target.com --output results.txt

Checks Performed

                        TEXT
                        
                    

                            # Version detection
# Admin page finder
# Core vulnerability checks
# Component enumeration and vulnerability checks
# robots.txt analysis
# Config file exposure (configuration.php.bak, .swp, etc.)
# Directory listing detection
# Firewall detection
                        

Common Workflows

BASH

                            # Quick Joomla scan
perl joomscan.pl -u https://target.com --ec

# Detect Joomla in scope then scan
wappalyzer https://target.com | grep -i joomla && perl joomscan.pl -u https://target.com --ec
                        