Joomscan (Joomla Vulnerability Scanner) is an open source tool written in Perl programming language that can detect and analyze Joomla CMS vulnerabilities.
Usage:
joomscan.pl -u <string> -x proxy:port-u <string> = joomla Url
==Optional==
-x <string:int> = proXy to tunnel
-c <string> = cookie (name=value;)
-g "<string>" = desired useraGent string within "
-nv = No Version fingerprinting check
-nf = No Firewall detection check
-nvf/-nfv = No version+firewall check
-pe = Poking version only
(and Exit the scanner)
-ot = Output to Text file (target-joexploit.txt)
-oh = Output to Html file (target-joexploit.htm)
-vu = Verbose (output every Url scan)
-sp = Show completed Percentage
Example: joomscan.pl -pv -u victim.com -x localhost:8080
Limitations in the current release of Joomscan:
- The vulnerability database still lacks of unknown exploit checks. If the exploit check is not available, the scanner verify based on deduced version. If deduced version is not available, it then cannot verify the vulnerability.
- The Scanner lacks IDS evasion bypass.
- The Scanner lacks sophisticated fuzzing.
- The Scanner is not a full fledged SQL Injection tool.
The developers are working on a new release of this tool, hopefully they will eliminate these limitations in the upcoming release.
You might also like:
Joomscan - Tool For Detecting & Analyzing Joomla CMS Vulnerabilities
Reviewed by AC10 Tech
on
Monday, January 23, 2017
Rating:
Reviewed by AC10 Tech
on
Monday, January 23, 2017
Rating:
No comments: