Joomla

Directory map

• Joomla — Discovery & Enumeration — footprinting, version fingerprinting, droopescan, JoomlaScan, login brute force
• Attacking Joomla — template RCE, web shell hygiene, CVE-2019-10945 directory traversal

Summary

Joomla is the second most widely deployed open-source CMS (~3% of all websites, ~2.5 million installs), making it a likely encounter during external assessments. Written in PHP with a MySQL backend, it follows a predictable directory structure that is largely self-disclosed via robots.txt (/administrator/, /components/, /plugins/, etc.) and the <meta name="generator"> tag in page source.

Version fingerprinting has multiple paths: /README.txt gives the major version, /administrator/manifests/files/joomla.xml gives the exact version via the <version> tag, and /plugins/system/cache/cache.xml gives an approximation. droopescan (droopescan scan joomla --url TARGET) provides a version range and surfaces interesting URLs. JoomlaScan (Python2) enumerates installed components and exposed directories under /components/ and /administrator/components/.

Unlike WordPress, Joomla’s login portal at /administrator/index.php returns a generic error message for both bad usernames and bad passwords, preventing the username enumeration oracle that WordPress exposes. The default admin username is admin; always try common defaults (admin:admin) before running a full brute-force with joomla-brute.py.

Attacking Joomla with admin credentials mirrors the WordPress approach: navigate to Configuration → Templates, select an inactive theme (e.g., protostar), and inject a PHP one-liner (system($_GET['<hash>']);) into error.php. The shell is served at /templates/protostar/error.php?<hash>=<cmd>. Use a non-dictionary parameter name to reduce opportunistic access, and remove the shell as soon as it is no longer needed. Known core vulnerabilities are rare — CVE-2019-10945 (directory traversal + authenticated file deletion, affecting 3.9.4) is notable, but template RCE is the primary path when admin credentials are available. The majority of Joomla CVEs target extensions, not core.