loading
Loading content
loading
Scanners
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
overview
joomscan is the OWASP Joomla scanner. Point --url at a Joomla install to fingerprint the version, enumerate components, and check known flaws plus admin and directory misconfigurations.
Enable --enumerate-components for third-party extensions. Pass a URL list with --mass. Soften traffic with --random-agent, --proxy, --cookie, or --timeout.
Trickest provides joomscan as a managed Scanners node. FILE and FOLDER reports out (text and HTML). Fingerprint with cmseek first; use wpscan for WordPress, nuclei for broad templates.
source github.com/OWASP/joomscan
use cases
Point joomscan at a Joomla URL to fingerprint the install and check it against known vulnerabilities and misconfigurations specific to the CMS.
Enable component enumeration so the scanner lists installed third-party extensions, the common source of exploitable Joomla bugs, and flags versions with known CVEs.
Pass a file of URLs with --mass so joomscan cycles through every host and reports per-site findings across an estate of Joomla deployments.
Rotate a random user agent and route through a proxy so the scan stays low-profile and you can inspect the requests it sends.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL or domain to scan. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate installed components. |
| urls-file | FILE | --mass | Cycle through URLs provided in a txt file. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set a cookie to send with requests. |
| timeout | STRING | --timeout | Set the request timeout. |
Showing key inputs. joomscan exposes 8 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | The Joomla URL/domain to scan. |
| proxy | STRING | --proxy | Use a proxy to connect to the target URL. |
| cookie | STRING | --cookie | Set cookie. |
| timeout | STRING | --timeout | Set timeout. |
| urls-file | FILE | --mass | Cycle through URLs provided in txt file. |
| user-agent | STRING | --user-agent | Use the specified User-Agent. |
| random-agent | BOOLEAN | --random-agent | Use a random User-Agent. |
| enumerate-components | BOOLEAN | --enumerate-components | Try to enumerate components. |
example
# fingerprint the version and enumerate components with a random agentjoomscan --url https://example.com --enumerate-components --random-agentProcessing http://example.com ...[+] Detecting Joomla Version[++] Joomla 3.9.24[+] Core Joomla Vulnerability[++] Target Joomla core is not vulnerable[+] Checking Directory Listing[++] directory has directory listing: http://example.com/administrator/components[+] Enumerating Components ...[++] com_content, com_contact enumeratedYour Report : reports/example.com/guidance
Reach for joomscan when the target is confirmed Joomla and you want CMS-specific checks, not a generic web scan. Fingerprint first. Prefer wpscan for WordPress and cmseek when you still need to identify the CMS.
WordPress-focused scanner. Use joomscan for Joomla, wpscan for WordPress.
Detects which CMS a site runs. Confirm Joomla with cmseek before joomscan.
Template-driven scanner with some Joomla templates. joomscan goes deeper on Joomla structure and components.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A URL is fingerprinted by cmseek, then joomscan scans the confirmed Joomla host and writes a text and HTML report for triage.
Facts on this page come from the live Trickest tool library.