A plugin-based scanner that aids security researchers in identifying issues with several CMS:
Partial functionality for:
- Joomla (version enumeration and interesting URLs only).
- Moodle (plugin & theme very limited, watch out)
* New versions for all CMS.
* Downgrade Drupal due to bad plugin detection on 8.x. PRs encouraged.
Installation is easy using pip:
apt-get install python-pip
pip install droopescan
Manual installation is as follows:
git clone https://github.com/droope/droopescan.git
pip install -r requirements.txt
./droopescan scan –help
Droopescan aims to be the most accurate by default, while not overloading the target server due to excessive concurrent requests. Due to this, by default, a large number of requests will be made with four threads; change these settings by using the –number and –threads arguments respectively.
This tool is able to perform four kinds of tests. By default, all tests are run, but you can specify one of the following with the -e or –enumerate flag:
- p — Plugin checks: Performs several thousand HTTP requests and returns a listing of all plugins found to be installed on the target host.
- t — Theme checks: As above, but for themes.
- v — Version checks: Downloads several files and, based on the checksums of these files, returns a list of all possible versions.
- i — Interesting url checks: Checks for interesting urls (admin panels, readme files, etc.)
Copyright (C) 2015 droope