Drupal

Directory map

• Drupal — Discovery & Enumeration — footprinting, node URLs, CHANGELOG version, droopescan, admin login
• Attacking Drupal — PHP filter module, backdoored modules, Drupalgeddon (CVE-2014-3704, CVE-2018-7600, CVE-2018-7602)

Summary

Drupal is the third most popular CMS (~2.4% market share, ~1.1 million sites), written in PHP with MySQL, PostgreSQL, or SQLite as the backend. It is heavily used by government (56% of government websites) and higher education (23.8% of universities), making it a likely target in public-sector assessments. It supports ~43,000 modules and ~2,900 themes.

Fingerprinting is straightforward when default settings are in place: the <meta name="Generator"> tag and “Powered by Drupal” footer are visible in page source, and all content pages follow a /node/<id> URL pattern. The robots.txt often references /node. Version fingerprinting via /CHANGELOG.txt works on older installs (Drupal 7 and some 8.x); newer installs block the file with a 404. The Drupal 8+ changelog is at /core/CHANGELOG.txt. droopescan (droopescan scan drupal -u TARGET) provides a version range and enumerates installed modules via LICENSE.txt files in /modules/ — significantly more capable than its Joomla mode. The admin login is at /user/login. The presence of the PHP module (/modules/php/) is a high-value finding, as it can enable authenticated code execution.