Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Scanners

Scan confirmed Joomla hosts for CMS-specific flaws

joomscan is OWASP's open-source Perl vulnerability scanner for Joomla CMS deployments that fingerprints the target, enumerates installed components and their known exploits, and detects misconfigurations, firewall presence, and common log or backup files, reporting in text and HTML.

installgit clone https://github.com/rezasp/joomscan.gitcd joomscanperl joomscan.pl

Raku · GPL-3.0 license

Agent
Scan a Joomla site for known flawsEnumerate vulnerable componentsSweep many Joomla installations

overview

What joomscan does

joomscan is the OWASP Joomla scanner. Point --url at a Joomla install to fingerprint the version, enumerate components, and check known flaws plus admin and directory misconfigurations.

Enable --enumerate-components for third-party extensions. Pass a URL list with --mass. Soften traffic with --random-agent, --proxy, --cookie, or --timeout.

Trickest provides joomscan as a managed Scanners node. FILE and FOLDER reports out (text and HTML). Fingerprint with cmseek first; use wpscan for WordPress, nuclei for broad templates.

source github.com/OWASP/joomscan

use cases

Where joomscan fits

Scan a Joomla site for known flaws

Point joomscan at a Joomla URL to fingerprint the install and check it against known vulnerabilities and misconfigurations specific to the CMS.

Enumerate vulnerable components

Enable component enumeration so the scanner lists installed third-party extensions, the common source of exploitable Joomla bugs, and flags versions with known CVEs.

Sweep many Joomla installations

Pass a file of URLs with --mass so joomscan cycles through every host and reports per-site findings across an estate of Joomla deployments.

Blend in with agent and proxy controls

Rotate a random user agent and route through a proxy so the scan stays low-profile and you can inspect the requests it sends.

reference

joomscan inputs and flags

8 inputs
NameTypeFlagDescription
urlSTRING--urlThe Joomla URL or domain to scan.
enumerate-componentsBOOLEAN--enumerate-componentsTry to enumerate installed components.
urls-fileFILE--massCycle through URLs provided in a txt file.
random-agentBOOLEAN--random-agentUse a random User-Agent.
proxySTRING--proxyUse a proxy to connect to the target URL.
cookieSTRING--cookieSet a cookie to send with requests.
timeoutSTRING--timeoutSet the request timeout.

Showing key inputs. joomscan exposes 8 inputs in total.

Full flag reference (8 inputs)
NameTypeFlagDescription
urlSTRING--urlThe Joomla URL/domain to scan.
proxySTRING--proxyUse a proxy to connect to the target URL.
cookieSTRING--cookieSet cookie.
timeoutSTRING--timeoutSet timeout.
urls-fileFILE--massCycle through URLs provided in txt file.
user-agentSTRING--user-agentUse the specified User-Agent.
random-agentBOOLEAN--random-agentUse a random User-Agent.
enumerate-componentsBOOLEAN--enumerate-componentsTry to enumerate components.

example

Run joomscan

joomscan · command
# fingerprint the version and enumerate components with a random agent
joomscan --url https://example.com --enumerate-components --random-agent
sample output
Processing http://example.com ...
[+] Detecting Joomla Version
[++] Joomla 3.9.24
[+] Core Joomla Vulnerability
[++] Target Joomla core is not vulnerable
[+] Checking Directory Listing
[++] directory has directory listing: http://example.com/administrator/components
[+] Enumerating Components ...
[++] com_content, com_contact enumerated
Your Report : reports/example.com/

guidance

Choosing joomscan

Reach for joomscan when the target is confirmed Joomla and you want CMS-specific checks, not a generic web scan. Fingerprint first. Prefer wpscan for WordPress and cmseek when you still need to identify the CMS.

wpscan

WordPress-focused scanner. Use joomscan for Joomla, wpscan for WordPress.

cmseek

Detects which CMS a site runs. Confirm Joomla with cmseek before joomscan.

nuclei

Template-driven scanner with some Joomla templates. joomscan goes deeper on Joomla structure and components.

faq

joomscan questions

Pass the target with --url, for example `joomscan --url https://example.com`. On Trickest, set the node's url input instead of typing the flag.

It lists installed third-party components, where many exploitable Joomla bugs live. Enable it to surface extension versions with known issues.

Yes. Pass a txt file of URLs with --mass and joomscan cycles through each host. On Trickest, wire that file into the urls-file input.

Pick joomscan for deep Joomla fingerprinting and component enumeration. Prefer nuclei when you want template-driven checks across many stacks, including some Joomla templates.

A CMS fingerprint step such as cmseek or a tech detector, so the scanner only runs against confirmed Joomla hosts.

related

More Scanners tools

  1. ac-scanner

    BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.

  2. airixss

    Reflection triage for parameter URLs during recon.

  3. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  4. cmseek

    CMS detection and version fingerprinting.

  5. jaeles

    Signature-driven web application scanner.

  6. nikto

    Bundled web server checks for dangerous files and outdated software.

Run joomscan yourself

A URL is fingerprinted by cmseek, then joomscan scans the confirmed Joomla host and writes a text and HTML report for triage.

Open joomscan in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.