Joomla — Discovery & Enumeration

Background

Joomla (released August 2005) is a free, open-source CMS written in PHP with MySQL as the backend. It powers approximately 3% of all websites (~2.5 million sites) and holds ~3.5% of the CMS market share — roughly 10% of WordPress’s reach. It supports 7,000+ extensions and 1,000+ templates.

Notable users: eBay, Yamaha, Harvard University, UK government.

Query live install counts via Joomla’s public API:

curl -s https://developer.joomla.org/stats/cms_version | python3 -m json.tool

Discovery / Footprinting

Page source — meta generator tag

curl -s http://dev.inlanefreight.local/ | grep Joomla

<meta name="generator" content="Joomla! - Open Source Content Management" />

robots.txt

A Joomla robots.txt exposes the application’s directory structure and is a strong fingerprint:

User-agent: *
Disallow: /administrator/
Disallow: /bin/
Disallow: /cache/
Disallow: /cli/
Disallow: /components/
Disallow: /includes/
Disallow: /installation/
Disallow: /language/
Disallow: /layouts/
Disallow: /libraries/
Disallow: /logs/
Disallow: /modules/
Disallow: /plugins/
Disallow: /tmp/

Version fingerprinting

Multiple paths can disclose the Joomla version:

README.txt (quick major version check):

curl -s http://dev.inlanefreight.local/README.txt | head -n 5

* This is a Joomla! installation/upgrade package to version 3.x

Exact version via manifest XML:

curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format -

<version>3.9.4</version>
<creationDate>March 2019</creationDate>

Enumeration

droopescan

Plugin-based scanner with support for SilverStripe, WordPress, Drupal, and limited Joomla/Moodle support.

Install:

sudo pip3 install droopescan

Scan:

droopescan scan joomla --url http://dev.inlanefreight.local/

Example output:

[+] Possible version(s):
    3.8.10
    3.8.11
    ...

[+] Possible interesting urls found:
    Detailed version information. - http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml
    Login page. - http://dev.inlanefreight.local/administrator/
    License file. - http://dev.inlanefreight.local/LICENSE.txt
    Version attribute contains approx version - http://dev.inlanefreight.local/plugins/system/cache/cache.xml

droopescan surfaces interesting URLs but typically returns a version range rather than an exact version.

JoomlaScan

Python2 tool inspired by OWASP joomscan. Enumerates installed components and exposed directories. Less up-to-date than droopescan but useful for mapping components.

Install dependency:

python2 -m pip install bs4

Run:

python2 joomlascan.py -u http://dev.inlanefreight.local

JoomlaScan checks for installed components (com_actionlogs, com_ajax, com_banners, etc.), their license XML files, and explorable directories under /components/ and /administrator/components/.

Login portal & user enumeration

The admin login portal is at:

http://<target>/administrator/index.php

Unlike WordPress, Joomla returns a generic error message for both invalid usernames and invalid passwords:

Warning: Username and password do not match or you do not have an account yet.

This prevents username enumeration at the login page. The default administrator username is admin; the password is set at install time and must be brute-forced or guessed.

Brute force

sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin

admin:admin

Always try common/default credentials first (admin:admin, admin:password, admin:joomla) before running a full wordlist.

Enumeration checklist

• Confirm Joomla via <meta name="generator"> tag or robots.txt Disallow paths
• Check /README.txt for major version
• Check /administrator/manifests/files/joomla.xml for exact version
• Check /plugins/system/cache/cache.xml for approximate version
• Run droopescan scan joomla for version range + interesting URLs
• Run joomlascan.py for component enumeration and exposed directories
• Note admin login at /administrator/index.php
• Attempt default/common credentials before brute-forcing