loading
Loading content
loading
Scanners
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
overview
joomscan is the OWASP Joomla scanner. Point --url at a Joomla install to fingerprint the version, enumerate components, and check known flaws plus admin and directory misconfigurations.
Enable --enumerate-components for third-party extensions. Pass a URL list with --mass. Soften traffic with --random-agent, --proxy, --cookie, or --timeout.
Trickest provides joomscan as a managed Scanners node. FILE and FOLDER reports out (text and HTML). Fingerprint with cmseek first; use wpscan for WordPress, nuclei for broad templates.
source github.com/OWASP/joomscan
use cases
Point joomscan at a Joomla URL to fingerprint the install and check it against known vulnerabilities and misconfigurations specific to the CMS.
Enable component enumeration so the scanner lists installed third-party extensions, the common source of exploitable Joomla bugs, and flags versions with known CVEs.
Pass a file of URLs with --mass so joomscan cycles through every host and reports per-site findings across an estate of Joomla deployments.
Rotate a random user agent and route through a proxy so the scan stays low-profile and you can inspect the requests it sends.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL or domain to scan. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate installed components. |
| urls-file | FILE | --mass | Cycle through URLs provided in a txt file. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set a cookie to send with requests. |
| timeout | STRING | --timeout | Set the request timeout. |
Showing key inputs. joomscan exposes 8 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL/domain to scan. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set cookie. |
| timeout | STRING | --timeout | Set timeout. |
| urls-file | FILE | --mass | Cycle through URLs provided in txt file. |
| user-agent | STRING | --user-agent | Use the specified User-Agent. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate components. |
example
# fingerprint the version and enumerate components with a random agentjoomscan --url https://example.com --enumerate-components --random-agentProcessing http://example.com ...[+] Detecting Joomla Version[++] Joomla 3.9.24[+] Core Joomla Vulnerability[++] Target Joomla core is not vulnerable[+] Checking Directory Listing[++] directory has directory listing: http://example.com/administrator/components[+] Enumerating Components ...[++] com_content, com_contact enumeratedYour Report : reports/example.com/guidance
Reach for joomscan when the target is confirmed Joomla and you want CMS-specific checks, not a generic web scan. Fingerprint first. Prefer wpscan for WordPress and cmseek when you still need to identify the CMS.
WordPress-focused scanner. Use joomscan for Joomla, wpscan for WordPress.
Detects which CMS a site runs. Confirm Joomla with cmseek before joomscan.
Template-driven scanner with some Joomla templates. joomscan goes deeper on Joomla structure and components.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
Modular multi-protocol credential brute forcer with response filtering.
A URL is fingerprinted by cmseek, then joomscan scans the confirmed Joomla host and writes a text and HTML report for triage.
Facts on this page come from the live Trickest tool library.