Scanners
Scan confirmed Joomla hosts for CMS-specific flaws
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
overview
What joomscan does
joomscan is the OWASP Joomla scanner. Point --url at a Joomla install to fingerprint the version, enumerate components, and check known flaws plus admin and directory misconfigurations.
Enable --enumerate-components for third-party extensions. Pass a URL list with --mass. Soften traffic with --random-agent, --proxy, --cookie, or --timeout.
Trickest provides joomscan as a managed Scanners node. FILE and FOLDER reports out (text and HTML). Fingerprint with cmseek first; use wpscan for WordPress, nuclei for broad templates.
source github.com/OWASP/joomscan
use cases
Where joomscan fits
Scan a Joomla site for known flaws
Point joomscan at a Joomla URL to fingerprint the install and check it against known vulnerabilities and misconfigurations specific to the CMS.
Enumerate vulnerable components
Enable component enumeration so the scanner lists installed third-party extensions, the common source of exploitable Joomla bugs, and flags versions with known CVEs.
Sweep many Joomla installations
Pass a file of URLs with --mass so joomscan cycles through every host and reports per-site findings across an estate of Joomla deployments.
Blend in with agent and proxy controls
Rotate a random user agent and route through a proxy so the scan stays low-profile and you can inspect the requests it sends.
reference
joomscan inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL or domain to scan. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate installed components. |
| urls-file | FILE | --mass | Cycle through URLs provided in a txt file. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set a cookie to send with requests. |
| timeout | STRING | --timeout | Set the request timeout. |
Showing key inputs. joomscan exposes 8 inputs in total.
Full flag reference (8 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL/domain to scan. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set cookie. |
| timeout | STRING | --timeout | Set timeout. |
| urls-file | FILE | --mass | Cycle through URLs provided in txt file. |
| user-agent | STRING | --user-agent | Use the specified User-Agent. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate components. |
example
Run joomscan
# fingerprint the version and enumerate components with a random agentjoomscan --url https://example.com --enumerate-components --random-agentProcessing http://example.com ...[+] Detecting Joomla Version[++] Joomla 3.9.24[+] Core Joomla Vulnerability[++] Target Joomla core is not vulnerable[+] Checking Directory Listing[++] directory has directory listing: http://example.com/administrator/components[+] Enumerating Components ...[++] com_content, com_contact enumeratedYour Report : reports/example.com/guidance
Choosing joomscan
Reach for joomscan when the target is confirmed Joomla and you want CMS-specific checks, not a generic web scan. Fingerprint first. Prefer wpscan for WordPress and cmseek when you still need to identify the CMS.
wpscan
WordPress-focused scanner. Use joomscan for Joomla, wpscan for WordPress.
cmseek
Detects which CMS a site runs. Confirm Joomla with cmseek before joomscan.
nuclei
Template-driven scanner with some Joomla templates. joomscan goes deeper on Joomla structure and components.
faq
joomscan questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
nikto
Bundled web server checks for dangerous files and outdated software.
Run joomscan yourself
A URL is fingerprinted by cmseek, then joomscan scans the confirmed Joomla host and writes a text and HTML report for triage.
Facts on this page come from the live Trickest tool library.