A python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs

Related tags

CMSCms_Scanner
Overview

CMSmap

CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool.

At the moment, CMSs supported by CMSmap are WordPress, Joomla, Drupal and Moodle.

Please note that this project is an early state. As such, you might find bugs, flaws or mulfunctions. Use it at your own risk!

Preview

Installation

You can download the latest version of CMSmap by cloning the GitHub repository:

 git clone https://github.com/Dionach/CMSmap

Then you need to configure the edbtype and edbpath settings in the cmsmap.conf. Use GIT if you have a local Git repository of Exploit-db :

[exploitdb]
edbtype = GIT
edbpath = /opt/exploitdb/

Alternatively, use APT if you have installed the debian exploitdb package. For Kali, use the following settings :

[exploitdb]
edbtype = APT
edbpath = /usr/share/exploitdb/

If you would like to run cmsmap from anywhere in your system you can install it with pip3 :

cd CMSmap
pip3 install .

To uninstall it :

pip3 uninstall cmsmap -y

Usage

usage: cmsmap [-f W/J/D] [-F] [-t] [-a] [-H] [-i] [-o] [-E] [-d] [-u] [-p]
              [-x] [-k] [-w] [-v] [-h] [-D] [-U W/J/D]
              [target]

CMSmap tool v1.0 - Simple CMS Scanner
Author: Mike Manzotti

Scan:
  target                target URL (e.g. 'https://example.com:8080/')
  -f W/J/D, --force W/J/D
                        force scan (W)ordpress, (J)oomla or (D)rupal
  -F, --fullscan        full scan using large plugin lists. False positives and slow!
  -t , --threads        number of threads (Default 5)
  -a , --agent          set custom user-agent
  -H , --header         add custom header (e.g. 'Authorization: Basic ABCD...')
  -i , --input          scan multiple targets listed in a given file
  -o , --output         save output in a file
  -E, --noedb           enumerate plugins without searching exploits
  -c, --nocleanurls     disable clean urls for Drupal only
  -s, --nosslcheck      don't validate the server's certificate
  -d, --dictattack      run low intense dictionary attack during scanning (5 attempts per user)

Brute-Force:
  -u , --usr            username or username file
  -p , --psw            password or password file
  -x, --noxmlrpc        brute forcing WordPress without XML-RPC

Post Exploitation:
  -k , --crack          password hashes file (Require hashcat installed. For WordPress and Joomla only)
  -w , --wordlist       wordlist file

Others:
  -v, --verbose         verbose mode (Default false)
  -h, --help            show this help message and exit
  -D, --default         rum CMSmap with default options
  -U, --update          use (C)MSmap, (P)lugins or (PC) for both

Examples:
  cmsmap.py https://example.com
  cmsmap.py https://example.com -f W -F --noedb -d
  cmsmap.py https://example.com -i targets.txt -o output.txt
  cmsmap.py https://example.com -u admin -p passwords.txt
  cmsmap.py -k hashes.txt -w passwords.txt

Contribution guidelines

If you want to contribute to CMSmap, be sure to review the contribution guidelines.

Disclaimer

Usage of CMSmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume NO liability and are NOT responsible for any misuse or damage caused by this program.

Owner
RazzorBack
"Silent Is Better Than Bullshit."
RazzorBack
A full stack e-learning application, this is the backend using django restframework and docker.

DevsPrime API API Service backing client interfaces Technologies Python 3.9 : Base programming language for development Bash Scripting : Create conven

Nnabue Favour Chukwuemeka 1 Oct 21, 2021
Crypt Wiki - VimWiki with added support for encryption/decryption

Crypt Wiki - VimWiki with added support for encryption/decryption This project is meant to solve an issue I have ran into recently. I wanted to have a

Adrian Costin 6 Dec 18, 2022
A website (webapp) to get food recipes by recipes names & ingredients.

Ramy's tedbira A website (aka: webapp) to get food recipes by recipes names & ingredients that you have in your fridge, using Django-framework and Spo

Rami Berrekia 15 Dec 23, 2022
Flask-SQLAlchemy implementation of nested/threaded comment replies.

Threaded comments using Common Table Expressions (CTE) for a MySQL Flask blog or CMS Credits to peterspython Also read more about the implementation h

ONDIEK ELIJAH OCHIENG 5 Nov 12, 2022
CMS for everyone, easy to deploy and scale, robust modular system with many packages.

Django-Leonardo Full featured platform for fast and easy building extensible web applications. Don't waste your time searching stable solution for dai

97 Nov 17, 2022
Django content management as it should be

Django content management as it should be. Documentation Read the full documentation or get a quick brief below. Install $ pip install djedi-cms Confi

5 Monkeys 75 Dec 13, 2022
CMS framework for Django

Created by Stephen McDonald Overview Mezzanine is a powerful, consistent, and flexible content management platform. Built using the Django framework,

Stephen McDonald 4.6k Dec 29, 2022
An encylopedia that runs on Django as part of CS50w's coursework

Django Wiki As part of the CS50w course, this project aims to apply the use of Django together with HTML and CSS to replicate an encyclopedia. Require

Beckham 1 Oct 28, 2021
Abilian Social Business Engine - an enterprise social networking / collaboration platform.

About Abilian SBE (Social Business Engine) is a platform for social business applications, and more specifically collaborative / enterprise 2.0 busine

Abilian open source projects 63 Dec 29, 2022
plumi video sharing

December 2017 update We are moving tickets from the Plumi tracker (trac.plumi.org) here, for historical reasons. Plumi video sharing system Plumi is a

Plumi 111 Dec 15, 2022
wger Workout Manager is a free, open source web application that helps you manage your personal workouts, weight and diet plans and can also be used as a simple gym management utility.

wger (ˈvɛɡɐ) Workout Manager is a free, open source web application that helps you manage your personal workouts, weight and diet plans and can also be used as a simple gym management utility.

wger Project 2k Dec 29, 2022
A modular, high performance, headless e-commerce platform built with Python, GraphQL, Django, and ReactJS.

Saleor Commerce Customer-centric e-commerce on a modern stack A headless, GraphQL-first e-commerce platform delivering ultra-fast, dynamic, personaliz

Mirumee Labs 17.8k Jan 07, 2023
Set of Web-backend projects to implement micro-blogging site

Mini-Twitter This repository contains a set of projects covered for CPSC-449 Web-Backend development under the guidance of Prof. Kenytt Avery at CSU,

1 Nov 07, 2021
A course management web application

umber a course management web app built with python Flask, sqlite3, and git. installation Tested on Ubuntu 18 with python 3.5. # -- Install the system

Jim Mahoney 6 Jun 03, 2022
Library Management system designed for managing and operating various aspects of a library

Proposal This proposal is written to clarify the project work of Information Systems, assigned to us as an individual task in order to tackle the case

Prawal 1 Oct 27, 2021
Link aggregator community organised by tags in python3/django3 + sqlite3.

sic Link aggregator community organised by tags in python3/django3 + sqlite3. Public instance at https://sic.pm and Tor hidden service.

Manos Pitsidianakis 97 Dec 30, 2022
ConnectLearn is an easy to use and deploy Open-Source Project meant to make it easier for the right students to find the right teachers online.

ConnectLearn ConnectLearn is an easy to use and deploy Open-Source Project meant to make it easier for the right students to find the right teachers o

Aditya 5 Oct 24, 2021
Journey is a journaling app where users can create their own journal and entries in it!

Journey is a journaling app where users can create their own journal and entries in it!

Hieu Ma 8 Dec 12, 2021
A plugin for Wagtail CMS, to have Icon Blocks (Fontawesome support)

WAGTAIL ICONIFY Library developed for Wagtail CMS, its purpose is to provide icon blocks from various libraries Special thanks to Alex Gleason, as wel

2 Jun 07, 2022
Ticket shop application for conferences, festivals, concerts, tech events, shows, exhibitions, workshops, barcamps, etc.

pretix Reinventing ticket presales, one ticket at a time. Project status & release cycle While there is always a lot to do and improve on, pretix by n

pretix 1.3k Jan 01, 2023