├── .github ├── CONTRIBUTING.md └── ISSUE_TEMPLATE.md ├── .gitignore ├── DISCLAIMER.txt ├── LICENSE.txt ├── README.md ├── __init__.py ├── cmsmap.py ├── cmsmap ├── __init__.py ├── cmsmap.conf ├── data │ ├── __init__.py │ ├── common_files.txt │ ├── conf_extensions.txt │ ├── dru_plugins.txt │ ├── joo_plugins.txt │ ├── wp_plugins.txt │ ├── wp_themes.txt │ ├── wp_themes_small.txt │ └── wp_timthumbs.txt ├── lib │ ├── __init__.py │ ├── bruteforcer.py │ ├── coreupdate.py │ ├── druscan.py │ ├── exploitdbsearch.py │ ├── genericchecks.py │ ├── initialize.py │ ├── jooscan.py │ ├── mooscan.py │ ├── postexploit.py │ ├── report.py │ ├── requester.py │ ├── scanner.py │ ├── threadscanner.py │ └── wpscan.py ├── main.py ├── shell │ ├── dru-shell.zip │ ├── joo-shell.zip │ └── wp-shell.zip └── version.py └── setup.py /.github/CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | Contribution Guidelines 2 | ===== 3 | Pull requests are more than welcome! Below a few guidlines for submitting contributions: 4 | 5 | * Fork the repository, create a new branch and submit your pull request. 6 | * Give your pull request a useful title and descriptive comments. 7 | * Make sure your local repo is up to date before submitting your pull request. 8 | * Rebase your commits to squash multiple commits into one before submitting your pull request. This keeps the main repo commit history clean and makes it easier to revent changes. 9 | * Use Python 3 10 | * Please TEST YOUR CONTRIBUTION! Be sure that your contribution works against all CMSs before submitting. After testing, changes will be merged to master. 11 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## Issue Details 2 | CMSmap Version: 3 | CMS Type: 4 | CMS Version: 5 | Plugin Name: 6 | OS Information: 7 | 8 | ## Steps to reproduce the issue 9 | 10 | Describe how to reproduce the issue 11 | 12 | ## Expected behaviour 13 | 14 | Describe how CMSmap should have handled the issue 15 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.pyc 2 | *_plugins_small.txt 3 | *_versions.txt 4 | *_defaultfiles.txt 5 | *_defaultfolders.txt 6 | cmsmap/tmp/ 7 | cmsmap/__pycache__/ 8 | *.egg-info 9 | .vscode 10 | build 11 | dist 12 | -------------------------------------------------------------------------------- /DISCLAIMER.txt: -------------------------------------------------------------------------------- 1 | Usage of CMSmap for attacking targets without prior mutual consent is illegal. 2 | It is the end user's responsibility to obey all applicable local, state and federal laws. 3 | Developers assume NO liability and are NOT responsible for any misuse or damage caused by this program. -------------------------------------------------------------------------------- /LICENSE.txt: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | {one line to give the program's name and a brief idea of what it does.} 635 | Copyright (C) {year} {name of author} 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | {project} Copyright (C) {year} {fullname} 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | CMSmap 2 | ====== 3 | 4 | CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool. 5 | 6 | At the moment, CMSs supported by CMSmap are WordPress, Joomla, Drupal and Moodle. 7 | 8 | Please note that this project is an early state. As such, you might find bugs, flaws or mulfunctions. 9 | Use it at your own risk! 10 | 11 | 12 | Preview 13 | ===== 14 | * https://asciinema.org/a/MELa2nUcrtATqnDLnc0ig8rcT 15 | 16 | 17 | Installation 18 | ===== 19 | You can download the latest version of CMSmap by cloning the GitHub repository: 20 | 21 | git clone https://github.com/Dionach/CMSmap 22 | 23 | Then you need to configure the `edbtype` and `edbpath` settings in the `cmsmap.conf`. Use `GIT` if you have a local Git repository of Exploit-db : 24 | 25 | [exploitdb] 26 | edbtype = GIT 27 | edbpath = /opt/exploitdb/ 28 | 29 | Alternatively, use `APT` if you have installed the `debian` exploitdb package. For Kali, use the following settings : 30 | 31 | [exploitdb] 32 | edbtype = APT 33 | edbpath = /usr/share/exploitdb/ 34 | 35 | If you would like to run `cmsmap` from anywhere in your system you can install it with `pip3` : 36 | 37 | cd CMSmap 38 | pip3 install . 39 | 40 | To uninstall it : 41 | 42 | pip3 uninstall cmsmap -y 43 | 44 | 45 | Usage 46 | ===== 47 | usage: cmsmap [-f W/J/D] [-F] [-t] [-a] [-H] [-i] [-o] [-E] [-d] [-u] [-p] 48 | [-x] [-k] [-w] [-v] [-h] [-D] [-U W/J/D] 49 | [target] 50 | 51 | CMSmap tool v1.0 - Simple CMS Scanner 52 | Author: Mike Manzotti 53 | 54 | Scan: 55 | target target URL (e.g. 'https://example.com:8080/') 56 | -f W/J/D, --force W/J/D 57 | force scan (W)ordpress, (J)oomla or (D)rupal 58 | -F, --fullscan full scan using large plugin lists. False positives and slow! 59 | -t , --threads number of threads (Default 5) 60 | -a , --agent set custom user-agent 61 | -H , --header add custom header (e.g. 'Authorization: Basic ABCD...') 62 | -i , --input scan multiple targets listed in a given file 63 | -o , --output save output in a file 64 | -E, --noedb enumerate plugins without searching exploits 65 | -c, --nocleanurls disable clean urls for Drupal only 66 | -s, --nosslcheck don't validate the server's certificate 67 | -d, --dictattack run low intense dictionary attack during scanning (5 attempts per user) 68 | 69 | Brute-Force: 70 | -u , --usr username or username file 71 | -p , --psw password or password file 72 | -x, --noxmlrpc brute forcing WordPress without XML-RPC 73 | 74 | Post Exploitation: 75 | -k , --crack password hashes file (Require hashcat installed. For WordPress and Joomla only) 76 | -w , --wordlist wordlist file 77 | 78 | Others: 79 | -v, --verbose verbose mode (Default false) 80 | -h, --help show this help message and exit 81 | -D, --default rum CMSmap with default options 82 | -U, --update use (C)MSmap, (P)lugins or (PC) for both 83 | 84 | Examples: 85 | cmsmap.py https://example.com 86 | cmsmap.py https://example.com -f W -F --noedb -d 87 | cmsmap.py https://example.com -i targets.txt -o output.txt 88 | cmsmap.py https://example.com -u admin -p passwords.txt 89 | cmsmap.py -k hashes.txt -w passwords.txt 90 | 91 | 92 | Contribution guidelines 93 | ===== 94 | If you want to contribute to CMSmap, be sure to review the [contribution 95 | guidelines](.github/CONTRIBUTING.md). 96 | 97 | 98 | Disclaimer 99 | ===== 100 | Usage of CMSmap for attacking targets without prior mutual consent is illegal. 101 | It is the end user's responsibility to obey all applicable local, state and federal laws. 102 | Developers assume NO liability and are NOT responsible for any misuse or damage caused by this program. 103 | -------------------------------------------------------------------------------- /__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/__init__.py -------------------------------------------------------------------------------- /cmsmap.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | import signal, sys 3 | 4 | from cmsmap.main import main 5 | from cmsmap.lib.report import report 6 | 7 | def exit(signum, frame): 8 | signal.signal(signal.SIGINT, original_sigint) 9 | try: 10 | msg = "Interrupt caught. CMSmap paused. Do you really want to exit?" 11 | report.error(msg) 12 | if input("[y/N]: ").lower().startswith('y'): 13 | msg = "Bye! Quitting.. " 14 | report.message(msg) 15 | sys.exit(1) 16 | except KeyboardInterrupt: 17 | msg = "Bye! Quitting.." 18 | report.message(msg) 19 | sys.exit(1) 20 | signal.signal(signal.SIGINT, exit) 21 | 22 | if __name__ == "__main__": 23 | original_sigint = signal.getsignal(signal.SIGINT) 24 | signal.signal(signal.SIGINT, exit) 25 | main() 26 | -------------------------------------------------------------------------------- /cmsmap/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/__init__.py -------------------------------------------------------------------------------- /cmsmap/cmsmap.conf: -------------------------------------------------------------------------------- 1 | [general] 2 | user-agent = Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7 3 | dataPath = data 4 | wordlist = wordlist/rockyou.txt 5 | common_files = data/common_files.txt 6 | conf_extensions = data/conf_extensions.txt 7 | 8 | [wordpress] 9 | wp_plugins = data/wp_plugins.txt 10 | wp_plugins_small = data/wp_plugins_small.txt 11 | wp_themes_small = data/wp_themes_small.txt 12 | wp_versions = data/wp_versions.txt 13 | wp_themes = data/wp_themes.txt 14 | wp_timthumbs = data/wp_timthumbs.txt 15 | wp_defaultFiles = data/wp_defaultfiles.txt 16 | wp_defaultFolders = data/wp_defaultfolders.txt 17 | 18 | [joomla] 19 | joo_plugins = data/joo_plugins.txt 20 | joo_plugins_small = data/joo_plugins_small.txt 21 | joo_versions = data/joo_versions.txt 22 | joo_defaultFiles = data/joo_defaultfiles.txt 23 | joo_defaultFolders = data/joo_defaultfolders.txt 24 | 25 | [drupal] 26 | dru_plugins = data/dru_plugins.txt 27 | dru_plugins_small = data/dru_plugins_small.txt 28 | dru_versions = data/dru_versions.txt 29 | dru_defaultFiles = data/dru_defaultfiles.txt 30 | dru_defaultFolders = data/dru_defaultfolders.txt 31 | 32 | [moodle] 33 | ; moo_plugins = data/moo_plugins.txt 34 | ; moo_plugins_small = data/moo_plugins_small.txt 35 | moo_versions = data/moo_versions.txt 36 | moo_defaultFiles = data/moo_defaultfiles.txt 37 | moo_defaultFolders = data/moo_defaultfolders.txt 38 | 39 | [exploitdb] 40 | edbtype = apt 41 | edbpath = /usr/share/exploitdb/ 42 | -------------------------------------------------------------------------------- /cmsmap/data/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/data/__init__.py -------------------------------------------------------------------------------- /cmsmap/data/common_files.txt: -------------------------------------------------------------------------------- 1 | .bash_profile 2 | .bashrc 3 | .db_config 4 | .default 5 | .logs 6 | .old 7 | .private 8 | .queries 9 | .query 10 | .secret 11 | .sql 12 | .temp 13 | .temp2 14 | 0 15 | 1 16 | 2 17 | 2010 18 | 2011 19 | 2012 20 | 2013 21 | 2014 22 | 2015 23 | 2016 24 | 2017 25 | 2018 26 | 2019 27 | 2020 28 | 3 29 | 4 30 | 5 31 | 6 32 | 7 33 | 8 34 | 9 35 | Documents 36 | Downloads 37 | files 38 | file 39 | Info 40 | Install 41 | PHPINFO 42 | PHPinfo 43 | Scripts 44 | Temp 45 | Test 46 | Tmp 47 | WebServices 48 | _ 49 | __ 50 | __admin 51 | __administrator 52 | __backup 53 | __backups 54 | __temp 55 | _admin 56 | _administrator 57 | _backup 58 | _backups 59 | _baks 60 | _inc 61 | _includes 62 | _index 63 | _index2 64 | _layouts 65 | _notes 66 | _private 67 | _scripts 68 | _temp 69 | _themes 70 | _vti_log 71 | _vti_map 72 | a 73 | account 74 | ad 75 | agents 76 | agreement 77 | album 78 | all 79 | amazon 80 | api 81 | apps 82 | ar 83 | archives 84 | articles 85 | audio 86 | awstats 87 | b 88 | backend 89 | backup 90 | backup2 91 | bak 92 | baks 93 | bash 94 | beta 95 | blocks 96 | blog 97 | board 98 | booking 99 | c 100 | c100 101 | c99 102 | cache 103 | calendar 104 | cards 105 | cc 106 | cgi.bin 107 | cgi_bin 108 | change_password 109 | charts 110 | chat 111 | checkout 112 | checkout-step2 113 | clean 114 | click 115 | clone 116 | cms 117 | com 118 | common 119 | config 120 | config2 121 | confirm 122 | connections 123 | core 124 | corporate 125 | cp 126 | customer 127 | cv 128 | d 129 | dashboard 130 | data 131 | data2 132 | date 133 | day 134 | db 135 | db_config 136 | db_config2 137 | default 138 | default2 139 | demo 140 | demo2 141 | dev 142 | development 143 | directory 144 | doc 145 | docs 146 | documents 147 | download_private 148 | dropbox 149 | drup 150 | wp 151 | joo 152 | drupal 153 | drupal2 154 | e 155 | email 156 | eng 157 | engine 158 | english 159 | error 160 | error2 161 | error403 162 | error_500 163 | error_log 164 | etc 165 | event 166 | export 167 | external 168 | f 169 | favorites 170 | fckeditor 171 | filter 172 | find 173 | flash 174 | forgot 175 | forgot2 176 | form 177 | forms 178 | forum 179 | fpdb 180 | friday 181 | ftp 182 | g 183 | gallery 184 | games 185 | general 186 | go 187 | groups 188 | h 189 | header 190 | footer 191 | help 192 | hi 193 | hidden 194 | hooks 195 | htmlarea 196 | http_error 197 | i 198 | iframes 199 | image 200 | imguploads 201 | index2 202 | index_old 203 | info 204 | insert 205 | install 206 | install2 207 | intranet 208 | iphone 209 | j 210 | jobs 211 | join 212 | joomla 213 | joomla2 214 | jquery 215 | jsp 216 | jwplayer 217 | k 218 | l 219 | l33t 220 | legal 221 | link 222 | list 223 | local 224 | log 225 | logs 226 | m 227 | mail 228 | main 229 | mambots 230 | manage 231 | manager 232 | menu 233 | message 234 | min 235 | module 236 | monday 237 | my_demo 238 | my_playlist 239 | my_video 240 | n 241 | nc 242 | net 243 | newsletters 244 | nobody 245 | nothing 246 | o 247 | objects 248 | old-cms 249 | old-config 250 | old-demo 251 | old-export 252 | old-query 253 | old-settings 254 | old-upload 255 | old-uploads 256 | old-welcome 257 | old_back 258 | old_backup 259 | old_chat 260 | old_cms 261 | old_config 262 | old_data 263 | old_demo 264 | old_documents 265 | old_login 266 | old_myaccount 267 | old_post 268 | old_print 269 | old_query 270 | old_settings 271 | old_sql 272 | old_stuff 273 | old_upload 274 | old_users 275 | olddata 276 | online 277 | other 278 | others 279 | p 280 | page2 281 | paid 282 | panel 283 | partners 284 | password 285 | passwords 286 | pay 287 | payment 288 | paypal 289 | pda 290 | perl 291 | photo 292 | photos 293 | php 294 | php3 295 | php4 296 | php5 297 | phpBB 298 | phpBB2 299 | phpBB3 300 | phpMyAdmin 301 | phpThumb 302 | php_uploads 303 | phpbb 304 | phpinfo 305 | phpmyadmin 306 | phpthumb 307 | ping 308 | piwik 309 | pkginfo 310 | player 311 | pma 312 | portfolio 313 | post 314 | post2 315 | print 316 | priv8 317 | private 318 | promo 319 | pt 320 | pub 321 | pwn 322 | pwn3d 323 | pwned 324 | q 325 | queries 326 | query 327 | r 328 | random 329 | redirect 330 | require 331 | results 332 | root 333 | s 334 | s3cr3t 335 | saturday 336 | schema 337 | se 338 | secret 339 | secure 340 | sendmessage 341 | service 342 | settings 343 | settings2 344 | setup 345 | shell 346 | shell2 347 | showgallery 348 | sign-in 349 | sign-up 350 | sitemap 351 | software 352 | source 353 | hello 354 | sp 355 | spy 356 | sql 357 | sql_queries 358 | src 359 | static 360 | statistics 361 | stats 362 | status 363 | stuff 364 | stuff2 365 | submit 366 | subscribe 367 | subscrption 368 | sunday 369 | survey 370 | swfplayer 371 | system 372 | t 373 | t0 374 | t1 375 | t2 376 | t3 377 | t4 378 | t5 379 | t6 380 | t7 381 | t8 382 | t9 383 | tabs 384 | temp 385 | temp2 386 | template 387 | term 388 | test 389 | test2 390 | test_login 391 | test_upload 392 | text 393 | thursday 394 | tiny_mce 395 | tl 396 | tmp 397 | tmp2 398 | travel 399 | tuesday 400 | txt 401 | typo3temp 402 | u 403 | uat 404 | uk 405 | umbraco 406 | up 407 | updates 408 | upload 409 | upload2 410 | uploads 411 | urllist 412 | user_login 413 | userdetails 414 | users 415 | users2 416 | utils 417 | v 418 | version 419 | w 420 | w00t 421 | wap 422 | web 423 | webapp 424 | webmail 425 | webmaster 426 | wednesday 427 | welcome 428 | welcome2 429 | widget 430 | wiki 431 | wordpress 432 | wordpress2 433 | write 434 | wwwboard 435 | x 436 | y 437 | yesterday 438 | z -------------------------------------------------------------------------------- /cmsmap/data/conf_extensions.txt: -------------------------------------------------------------------------------- 1 | 2 | .php~ 3 | .php.txt 4 | .php.old 5 | .php_old 6 | .php-old 7 | .php.save 8 | .php.swp 9 | .php.swo 10 | .php_bak 11 | .php-bak 12 | .php.original 13 | .php.old 14 | .php.orig 15 | .php.bak 16 | .save 17 | .old 18 | .bak 19 | .orig 20 | .original 21 | .txt 22 | -------------------------------------------------------------------------------- /cmsmap/data/joo_plugins.txt: -------------------------------------------------------------------------------- 1 | com_5starhotels 2 | com_aardvertiser 3 | com_ab_gallery 4 | com_abbrev 5 | com_abc 6 | com_about 7 | com_acajoom 8 | com_accombo 9 | com_acctexp 10 | com_aclassf 11 | com_acmisc 12 | com_acooldebate 13 | com_acprojects 14 | com_acstartseite 15 | com_acteammember 16 | com_actions 17 | com_activities 18 | com_actualite 19 | com_adagency 20 | com_addressbook 21 | com_adds 22 | com_adsmanager 23 | com_advertising 24 | com_agency 25 | com_agenda 26 | com_agora 27 | com_agoragroup 28 | com_ahsshop 29 | com_airmonoblock 30 | com_akobook 31 | com_akogallery 32 | com_alameda 33 | com_alberghi 34 | com_album 35 | com_alert 36 | com_alfresco 37 | com_alfurqan15x 38 | com_allcinevid 39 | com_allhotels 40 | com_allvideos 41 | com_alphacontent 42 | com_alphauserpoints 43 | com_altas 44 | com_amblog 45 | com_ambrasubs 46 | com_aml_2 47 | com_amocourse 48 | com_annonces 49 | com_appointinator 50 | com_appointment 51 | com_arcadegames 52 | com_archeryscores 53 | com_artforms 54 | com_articleman 55 | com_articlemanager 56 | com_articles 57 | com_artist 58 | com_artportal 59 | com_as 60 | com_asortyment 61 | com_autartimonial 62 | com_autartitarot 63 | com_avosbillets 64 | com_awd_song 65 | com_awdwall 66 | com_awesom 67 | com_awiki 68 | com_b2portfolio 69 | com_banners 70 | com_bca-rss-syndicator 71 | com_beamospetition 72 | com_bearleague 73 | com_beeheard 74 | com_beeheardlite 75 | com_bfquiztrial 76 | com_bfsurvey 77 | com_bfsurvey_pro 78 | com_biblestudy 79 | com_biblioteca 80 | com_bidding 81 | com_biitatemplateshop 82 | com_billyportfolio 83 | com_biographies 84 | com_bit 85 | com_blabla 86 | com_blablubb 87 | com_blastchatc 88 | com_blog 89 | com_blogfactory 90 | com_book 91 | com_bookflip 92 | com_bookjoomlas 93 | com_books 94 | com_boss 95 | com_br 96 | com_brightweblinks 97 | com_bsadv 98 | com_bulkenquery 99 | com_business 100 | com_buslicense 101 | com_ca 102 | com_calendario 103 | com_camelcitydb2 104 | com_camp 105 | com_candle 106 | com_canteen 107 | com_caproductprices 108 | com_carman 109 | com_cartweberp 110 | com_casino 111 | com_casino_blackjack 112 | com_casino_videopoker 113 | com_casinobase 114 | com_catalogproduction 115 | com_catalogshop 116 | com_categories 117 | com_category 118 | com_cbcontact 119 | com_cbe 120 | com_cbresumebuilder 121 | com_ccboard 122 | com_ccinvoices 123 | com_ccnewsletter 124 | com_cgtestimonial 125 | com_charts 126 | com_chronoconnectivity 127 | com_chronoconnectivity" / 128 | com_chronocontact 129 | com_chronocontact" / 130 | com_cinema 131 | com_ckforms 132 | com_clanlist 133 | com_clantools 134 | com_clasifier 135 | com_cloner 136 | com_cmimarketplace 137 | com_collector 138 | com_color 139 | com_comments 140 | com_community 141 | com_communitypolls 142 | com_comp 143 | com_comprofiler 144 | com_connect 145 | com_contact 146 | com_contactinfo 147 | com_content 148 | com_contentbloglist 149 | com_controller 150 | com_countries 151 | com_crowdsource 152 | com_custompages 153 | com_cvmaker 154 | com_cx 155 | com_d-greinar 156 | com_d3000 157 | com_dailymeals 158 | com_dailymessage 159 | com_dashboard 160 | com_datafeeds 161 | com_dateconverter 162 | com_datsogallery 163 | com_dbquery 164 | com_dcnews 165 | com_dcs_flashgames 166 | com_delicious 167 | com_departments 168 | com_detail 169 | com_dhforum 170 | com_diary 171 | com_digifolio 172 | com_digistore 173 | com_dioneformwizard 174 | com_directory 175 | com_discussions 176 | com_djartgallery 177 | com_djcatalog 178 | com_djclassifieds 179 | com_djiceshoutbox 180 | com_dm_orders 181 | com_dms 182 | com_doc 183 | com_docman 184 | com_doqment 185 | com_downloads 186 | com_drawroot 187 | com_dshop 188 | com_dtregister 189 | com_dwgraphs 190 | com_easybook 191 | com_easygb 192 | com_ecommercewd 193 | com_econtent 194 | com_education_classes 195 | com_education_classess 196 | com_elite_experts 197 | com_ensenanzas 198 | com_eportfolio 199 | com_equipment 200 | com_equotes 201 | com_estateagent 202 | com_event 203 | com_eventcal 204 | com_eventing 205 | com_eventlist 206 | com_expedition 207 | com_expose 208 | com_expshop 209 | com_extplorer 210 | com_ezautos 211 | com_ezine 212 | com_ezstore 213 | com_fabrik 214 | com_facebook 215 | com_facegallery 216 | com_facileforms 217 | com_family 218 | com_fantasytournament 219 | com_fastball 220 | com_fbb 221 | com_filebase 222 | com_filiale 223 | com_finder 224 | com_fireboard 225 | com_flash 226 | com_flashgames 227 | com_flashmagazinedeluxe 228 | com_flexicontent 229 | com_flippingbook 230 | com_flipwall 231 | com_foobla_suggestions 232 | com_football 233 | com_formmaker 234 | com_formtool 235 | com_foto 236 | com_fq 237 | com_frontenduseraccess 238 | com_frontpage 239 | com_fss 240 | com_g2bridge 241 | com_gadgetfactory 242 | com_galeria 243 | com_galleries 244 | com_gallery 245 | com_galleryxml 246 | com_gambling 247 | com_gameq 248 | com_gamesbox 249 | com_gameserver 250 | com_ganalytics 251 | com_garyscookbook 252 | com_gbufacebook 253 | com_gcalendar 254 | com_gds 255 | com_genealogy 256 | com_giftexchange 257 | com_gigcal 258 | com_gigfe 259 | com_gmaps 260 | com_golfcourseguide 261 | com_google 262 | com_graphics 263 | com_grid 264 | com_groups 265 | com_gsticketsystem 266 | com_guide 267 | com_gurujibook 268 | com_hbssearch 269 | com_hdflvplayer 270 | com_hdvideoshare 271 | com_hello 272 | com_hello_world 273 | com_helpdeskpro 274 | com_hezacontent 275 | com_hmcommunity 276 | com_horoscope 277 | com_horses 278 | com_hospital 279 | com_hotbrackets 280 | com_hsconfig 281 | com_huruhelpdesk 282 | com_hwdvideoshare 283 | com_icagenda 284 | com_ice 285 | com_icrmbasic 286 | com_icrmbasicdemo 287 | com_idoblog 288 | com_if_nexus 289 | com_if_surfalert 290 | com_ignitegallery 291 | com_iigcatalog 292 | com_ijoomla_archive 293 | com_ijoomla_rss 294 | com_imagebrowser 295 | com_img 296 | com_include 297 | com_inter 298 | com_iomezun 299 | com_iproperty 300 | com_is 301 | com_itarmory 302 | com_items 303 | com_j-projects 304 | com_jabode 305 | com_jacomment 306 | com_jajobboard 307 | com_janews 308 | com_jashowcase 309 | com_javoice 310 | com_jb2 311 | com_jbook 312 | com_jbpublishdownfp 313 | com_jbudgetsmagic 314 | com_jce 315 | com_jcollection 316 | com_jcommunity 317 | com_jdownloads 318 | com_jdrugstopics 319 | com_jeajaxeventcalendar 320 | com_jeauto 321 | com_jedirectory 322 | com_jeemasms 323 | com_jefaqpro 324 | com_jeformcr 325 | com_jeguestbook 326 | com_jejob 327 | com_jepoll 328 | com_jequizmanagement 329 | com_jequoteform 330 | com_jesubmit 331 | com_jfeedback 332 | com_jfuploader 333 | com_jfusion 334 | com_jgen 335 | com_jgrid 336 | com_jigsaw 337 | com_jimtawl 338 | com_jinc 339 | com_jinventory 340 | com_jlord_rss 341 | com_jmarket 342 | com_jmovies 343 | com_jmsfileseller 344 | com_jnews HTTP/ 345 | com_jnewspaper 346 | com_joaktree 347 | com_job 348 | com_jobads 349 | com_jobline 350 | com_jobprofile 351 | com_jokes 352 | com_joltcard 353 | com_jombib 354 | com_jombib -- 355 | com_jomestate 356 | com_joobb 357 | com_jooget 358 | com_joomclip 359 | com_joomdle 360 | com_joomgalaxy 361 | com_joomgallery 362 | com_joomlaboard 363 | com_joomlaconnect_be 364 | com_joomladate 365 | com_joomlaflickr 366 | com_joomlapicasa2 367 | com_joomlaupdater 368 | com_joomlavvz 369 | com_joomlaxplorer 370 | com_joomloads 371 | com_joomloc 372 | com_joomlub 373 | com_joommail 374 | com_joomnik 375 | com_joomportfolio 376 | com_joomradio 377 | com_joomtouch 378 | com_joomtracker 379 | com_jooproperty 380 | com_joovideo 381 | com_jotloader 382 | com_jp_jobs 383 | com_jpad 384 | com_jphone 385 | com_jphoto 386 | com_jpodium 387 | com_jprojectmanager 388 | com_jquarks4s 389 | com_jr_tfb 390 | com_jradio 391 | com_jresearch 392 | com_jreservation 393 | com_jscalendar 394 | com_jshop 395 | com_jsjobs 396 | com_jstore 397 | com_jsubscription 398 | com_jsupport 399 | com_jtickets 400 | com_jtips 401 | com_jtm 402 | com_juicy 403 | com_jukebox 404 | com_juliaportfolio 405 | com_jumi 406 | com_juser 407 | com_jvehicles 408 | com_jvideo 409 | com_jvideodirect 410 | com_jwhmcs 411 | com_k2 412 | com_kbase 413 | com_kif_nexus 414 | com_king 415 | com_kk 416 | com_kkcontent 417 | com_konsultasi 418 | com_ksadvertiser 419 | com_kunena 420 | com_lead 421 | com_leader 422 | com_letterman 423 | com_lexikon 424 | com_libros 425 | com_linkr 426 | com_listbingo 427 | com_listing 428 | com_liveticker 429 | com_lms 430 | com_loginbox 431 | com_lovefactory 432 | com_lowcosthotels 433 | com_lyftenbloggie 434 | com_macgallery 435 | com_mad4joomla 436 | com_magazine 437 | com_maianmedia 438 | com_maianmusic 439 | com_mailto 440 | com_mambads 441 | com_mamml 442 | com_manager 443 | com_maplocator 444 | com_market 445 | com_marketplace 446 | com_markt 447 | com_matamko 448 | com_mcquiz 449 | com_mdigg 450 | com_media 451 | com_mediaalert 452 | com_mediamall 453 | com_mediaslide 454 | com_mediqna 455 | com_memory 456 | com_menu 457 | com_menumanager 458 | com_menus 459 | com_messages 460 | com_mezun 461 | com_misterestate 462 | com_miwoftp 463 | com_mmsblog 464 | com_model 465 | com_modules 466 | com_morfeoshow 467 | com_mosres 468 | com_most 469 | com_movm 470 | com_mscomment 471 | com_mtfireeagle 472 | com_multimap 473 | com_multiroot 474 | com_musepoes 475 | com_musica 476 | com_musicgallery 477 | com_mv_restaurantmenumanager 478 | com_myalbum 479 | com_myblog 480 | com_mycar 481 | com_mycontent 482 | com_mydyngallery 483 | com_myfiles 484 | com_mygallery 485 | com_myhome 486 | com_mysms 487 | com_n-forms 488 | com_n-gallery 489 | com_n-skyrslur 490 | com_na_content 491 | com_na_newsdescription 492 | com_neogallery 493 | com_neorecruit 494 | com_neoreferences 495 | com_netinvoice 496 | com_network 497 | com_news 498 | com_news_portal 499 | com_newsfeeds 500 | com_newsflash 501 | com_newsletter 502 | com_newssearch 503 | com_nfnaddressbook 504 | com_niceajaxpoll 505 | com_nicetalk 506 | com_ninjacentral 507 | com_ninjamonials 508 | com_ninjarsssyndicator 509 | com_nkc 510 | com_noticeboard 511 | com_noticia 512 | com_noticias 513 | com_obsuggest 514 | com_omnirealestate 515 | com_omphotogallery 516 | com_ongallery 517 | com_onlineexam 518 | com_oprykningspoint_mc 519 | com_ops 520 | com_org 521 | com_orgchart 522 | com_otzivi 523 | com_ownbiblio 524 | com_oziogallery 525 | com_packages 526 | com_pandafminigames 527 | com_party 528 | com_paxgallery 529 | com_paxxgallery 530 | com_pbbooking 531 | com_pc 532 | com_pcchess 533 | com_pccookbook 534 | com_people 535 | com_perchacategoriestree 536 | com_perchadownloadsattach 537 | com_perchafieldsattach 538 | com_perchagallery 539 | com_perchaimageattach 540 | com_personal 541 | com_philaform 542 | com_phocadocumentation 543 | com_phocadownload 544 | com_phocagallery 545 | com_photobattle 546 | com_photoblog 547 | com_photomapgallery 548 | com_php 549 | com_picasa2gallery 550 | com_picsell 551 | com_pinboard 552 | com_plugins 553 | com_pms 554 | com_poll 555 | com_ponygallery 556 | com_portafolio 557 | com_portfol 558 | com_portfolio 559 | com_powermail 560 | com_prayercenter 561 | com_press 562 | com_pressrelease 563 | com_preventive 564 | com_prime 565 | com_pro_desk 566 | com_prod 567 | com_productbook 568 | com_products 569 | com_productshowcase 570 | com_profile 571 | com_projectfork 572 | com_properties 573 | com_propertylab 574 | com_puarcade 575 | com_publication 576 | com_qcontacts 577 | com_qcontacts" / 578 | com_qcontacts?=catid=0 579 | com_qpersonel 580 | com_question 581 | com_quickfaq 582 | com_quicknews 583 | com_quiz 584 | com_quran 585 | com_races 586 | com_radio 587 | com_ranking 588 | com_rapidrecipe 589 | com_rd_download 590 | com_rdautos 591 | com_realtyna 592 | com_recerca 593 | com_recipe 594 | com_recipes 595 | com_recly 596 | com_record 597 | com_redirect 598 | com_redshop 599 | com_redtwitter 600 | com_referenzen 601 | com_rekry 602 | com_remository 603 | com_reservations 604 | com_resman 605 | com_restaurant 606 | com_restaurante 607 | com_restaurantguide 608 | com_ricette 609 | com_rokdownloads 610 | com_rokmodule 611 | com_route 612 | com_rpx 613 | com_rsappt_pro2 614 | com_rsfiles 615 | com_rsgallery 616 | com_rsgallery2 617 | com_rss 618 | com_rwcards 619 | com_s5clanroster 620 | com_salesrep 621 | com_sar_news 622 | com_sbsfile 623 | com_scheduling 624 | com_school 625 | com_schools 626 | com_science 627 | com_search 628 | com_searchlog 629 | com_sebercart 630 | com_sectionex 631 | com_sections 632 | com_seek 633 | com_sef 634 | com_sef" / 635 | com_seminar 636 | com_serie 637 | com_sermon 638 | com_sermonspeaker 639 | com_seyret 640 | com_seyret" / 641 | com_sg 642 | com_sgicatalog 643 | com_shop 644 | com_shoutbox 645 | com_siirler 646 | com_simple_review 647 | com_simpleboard 648 | com_simpledownload 649 | com_simplefaq 650 | com_simpleimageupload 651 | com_simplephotogallery 652 | com_simpleshop 653 | com_smartsite 654 | com_smestorage 655 | com_smslist 656 | com_socialads 657 | com_software 658 | com_solution 659 | com_some 660 | com_soundset 661 | com_spa 662 | com_spain 663 | com_spec 664 | com_spidercalendar 665 | com_spidercatalog 666 | com_spidercontacts 667 | com_spiderfaq 668 | com_spielothek 669 | com_sponsorwall 670 | com_sportfusion 671 | com_spsnewsletter 672 | com_start 673 | com_staticxt 674 | com_surveymanager 675 | com_svmap 676 | com_sweetykeeper 677 | com_tags 678 | com_tariff 679 | com_teacher 680 | com_team 681 | com_tech_article 682 | com_techfolio 683 | com_television 684 | com_templates 685 | com_thyme 686 | com_ticketbook 687 | com_tickets 688 | com_tienda 689 | com_timereturns 690 | com_timetrack 691 | com_tophotelmodule 692 | com_topmenu 693 | com_tour 694 | com_tpdugg 695 | com_tpjobs 696 | com_trabalhe_conosco 697 | com_trading 698 | com_trash 699 | com_travelbook 700 | com_tree 701 | com_tsonymf 702 | com_ttvideo 703 | com_tupinambis 704 | com_tweetla 705 | com_ultimateportfolio 706 | com_units 707 | com_user 708 | com_users 709 | com_userstatus 710 | com_versioning 711 | com_videos 712 | com_vikrealestate 713 | com_virtualmoney 714 | com_virtuemart 715 | com_visa 716 | com_vjdeo 717 | com_voj 718 | com_volunteer 719 | com_vr 720 | com_vxdate 721 | com_wallpapers 722 | com_waticketsystem 723 | com_wdsubscriptions 724 | com_webeecomment 725 | com_weberpcustomer 726 | com_weblinks 727 | com_webtv 728 | com_webtvcom_5starhotels 729 | com_wgpicasa 730 | com_wines 731 | com_wisroyq 732 | com_wmi 733 | com_wmtpic 734 | com_worldrates 735 | com_wrapper 736 | com_xcomp 737 | com_xeslidegalfx 738 | com_xevidmegahd 739 | com_xewebtv 740 | com_xfaq 741 | com_xobbix 742 | com_xvs 743 | com_yanc 744 | com_ybggal 745 | com_yellowpages 746 | com_yelp 747 | com_yjcontactus 748 | com_ynews 749 | com_youtube 750 | com_youtubegallery 751 | com_yvcomment 752 | com_zcalendar 753 | com_zimbcomment 754 | com_zimbcore 755 | com_zina 756 | com_zoom 757 | com_zoomportfolio 758 | com_ztautolink 759 | -------------------------------------------------------------------------------- /cmsmap/data/wp_themes_small.txt: -------------------------------------------------------------------------------- 1 | Avada 2 | Centum 3 | Divi 4 | IncredibleWP 5 | THEME 6 | ThinkResponsive 7 | acento 8 | agritourismo-theme 9 | amplus 10 | archin 11 | area53 12 | beach_apollo 13 | bordeaux-theme 14 | bulteno-theme 15 | cuckootap 16 | curvo 17 | dandelion 18 | default 19 | designfolio-plus 20 | diary 21 | dimension 22 | euclid 23 | gazette 24 | highlight 25 | kernel-theme 26 | limon 27 | linenity 28 | livewire-edition 29 | make_a_statement 30 | medicate 31 | oxygen-theme 32 | parallax 33 | persuasion 34 | radial-theme 35 | rayoflight-theme 36 | reganto-theme 37 | rockstar-theme 38 | saico 39 | striking_r 40 | switchblade 41 | -------------------------------------------------------------------------------- /cmsmap/lib/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/lib/__init__.py -------------------------------------------------------------------------------- /cmsmap/lib/bruteforcer.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import sys, urllib, re, http.cookiejar, ssl 3 | 4 | # Import Objects 5 | from .initialize import initializer 6 | from .report import report 7 | from .requester import requester 8 | 9 | # Import Classes 10 | from .threadscanner import MyHandler 11 | 12 | 13 | # Perform brute-force, dictionary attacks 14 | class BruteForcer: 15 | 16 | def __init__(self): 17 | self.force = None 18 | self.wpnoxmlrpc = True 19 | self.url = None 20 | self.usrlist = None 21 | self.pswlist = None 22 | self.dictattack = None 23 | 24 | # Read the wordlist and start brute-force attack 25 | def Start(self): 26 | if type(self.usrlist) is str: 27 | try: 28 | self.usrlist = [line.strip() for line in open(self.usrlist)] 29 | except IOError: 30 | self.usrlist = [self.usrlist] 31 | if type(self.pswlist) is str: 32 | try: 33 | self.pswlist = [line.strip() for line in open(self.pswlist)] 34 | except IOError: 35 | self.pswlist = [self.pswlist] 36 | 37 | if self.force is not None: 38 | msg = "Starting Brute Forcing: " + self.force 39 | report.message(msg) 40 | if self.force == 'W': 41 | if self.wpnoxmlrpc: 42 | self.WPXMLRPC_brute() 43 | else: 44 | self.WPrun() 45 | elif self.force == 'J': 46 | self.Joorun() 47 | elif self.force == 'D': 48 | self.Drurun() 49 | else: 50 | msg = "Not Valid Option Provided: use (W)ordpress, (J)oomla, (D)rupal" 51 | report.error(msg) 52 | sys.exit(1) 53 | 54 | # Find credentials via WordPress XML-RPC 55 | def WPXMLRPC_brute(self): 56 | msg = "Starting XML-RPC Brute Forcing" 57 | report.verbose(msg) 58 | for user in self.usrlist: 59 | self.pswlist.append(user) 60 | for pwd in self.pswlist: 61 | self.postdata = ( 62 | 'wp.getUsersBlogs' 63 | '' + user + 64 | '' 65 | '' + pwd + 66 | '') 67 | msg = "Trying Credentials: " + user + " " + pwd 68 | report.verbose(msg) 69 | requester.noredirect(self.url + '/xmlrpc.php', self.postdata) 70 | if re.search('isAdmin0', requester.htmltext): 71 | msg = "Valid Credentials! Username: " + user + " Password: " + pwd 72 | report.high(msg) 73 | elif re.search('isAdmin1', requester.htmltext): 74 | msg = "Valid ADMIN Credentials! Username: " + user + " Password: " + pwd 75 | report.high(msg) 76 | 77 | # Find credentials brute-forcing the wp-login.php page 78 | def WPrun(self): 79 | msg = "Starting Brute Forcing" 80 | report.verbose(msg) 81 | self.wplogin = "/wp-login.php" 82 | usersFound = [] 83 | for user in self.usrlist: 84 | self.pswlist.append(user) # try username as password 85 | for pwd in self.pswlist: 86 | self.postdata = {"log": user, "pwd": pwd, "wp-submit": "Log+In"} 87 | msg = "Trying Credentials: " + user + " " + pwd 88 | report.verbose(msg) 89 | requester.requestcookie(self.url + self.wplogin, self.postdata) 90 | if re.search('ERROR: Invalid username', requester.htmltext): 91 | msg = "Invalid Username: " + user 92 | report.message(msg) 93 | break 94 | elif re.search('username (.+?) is incorrect.', requester.htmltext): 95 | usersFound.append(user) 96 | elif re.search('ERROR.*blocked.*', requester.htmltext, re.IGNORECASE): 97 | msg = "Account Lockout Enabled: Your IP address has been temporary blocked. Try it later or from a different IP address" 98 | report.error(msg) 99 | return 100 | elif re.search('wordpress_logged_in_', str(requester.cookieJar), re.IGNORECASE): 101 | msg = "Valid Credentials: " + user + " " + pwd 102 | report.high(msg) 103 | # remove user 104 | self.pswlist.pop() 105 | 106 | # Find credentials brute-forcing the /administrator/index.php page 107 | def Joorun(self): 108 | # It manages token and Cookies 109 | self.joologin = "/administrator/index.php" 110 | self.JooValidCredentials = [] 111 | for user in self.usrlist: 112 | # Get Token and Session Cookie 113 | requester.requestcookie(self.url + self.joologin, data=None) 114 | reg = re.compile('Index of", requester.htmltext, re.IGNORECASE) 49 | if dirList: 50 | msg = self.url + self.relPath 51 | report.low(msg) 52 | 53 | # Check if website is over HTTPS 54 | def HTTPSCheck(self): 55 | msg = "Checking if the website is in HTTPS ..." 56 | report.verbose(msg) 57 | pUrl = urlparse(self.url) 58 | scheme = pUrl.scheme.lower() 59 | if scheme == 'http': 60 | # check HTTPS redirection 61 | requester.noredirect(self.url, data=None) 62 | if requester.status_code == 200 : 63 | msg = "Website Not in HTTPS: " + self.url 64 | report.medium(msg) 65 | else: 66 | redirected = re.search("https", str(requester.htmltext), re.IGNORECASE) 67 | if requester.status_code != 302 and not redirected: 68 | msg = "Website Not in HTTPS: " + self.url 69 | report.medium(msg) 70 | 71 | # Check Security Headers 72 | def HeadersCheck(self): 73 | requester.request(self.url, data=None) 74 | msg = "Checking headers ..." 75 | report.verbose(msg) 76 | if requester.response.info().get('Server'): 77 | msg = "Server: " + requester.response.info().get('Server') 78 | report.info(msg) 79 | if requester.response.info().get('X-Powered-By'): 80 | msg = "X-Powered-By: " + requester.response.info().get('X-Powered-By') 81 | report.info(msg) 82 | if requester.response.info().get('X-Generator'): 83 | msg = "X-Generator: " + requester.response.info().get('X-Generator') 84 | report.low(msg) 85 | if requester.response.info().get('x-xss-protection') == '0': 86 | msg = "X-XSS-Protection Disabled" 87 | report.high(msg) 88 | if not requester.response.info().get('x-frame-options') or ( 89 | requester.response.info().get('x-frame-options').lower() != 'sameorigin' or 'deny'): 90 | msg = "X-Frame-Options: Not Enforced" 91 | report.low(msg) 92 | if not requester.response.info().get('strict-transport-security'): 93 | msg = "Strict-Transport-Security: Not Enforced" 94 | report.info(msg) 95 | if not requester.response.info().get('x-content-security-policy'): 96 | msg = "X-Content-Security-Policy: Not Enforced" 97 | report.info(msg) 98 | if not requester.response.info().get('x-content-type-options'): 99 | msg = "X-Content-Type-Options: Not Enforced" 100 | report.info(msg) 101 | 102 | # Check if AutoComplete is set to Off on login pages 103 | def AutocompleteOff(self, relPath): 104 | msg = "Checking Autocomplete Off on the login page ..." 105 | report.verbose(msg) 106 | self.relPath = relPath 107 | requester.request(self.url + self.relPath, data=None) 108 | autoComp = re.search("autocomplete=\"off\"", requester.htmltext,re.IGNORECASE) 109 | if not autoComp: 110 | msg = "Autocomplete Off Not Found: " + self.url + self.relPath 111 | report.info(msg) 112 | 113 | # Check if robots.txt is available 114 | def RobotsTXT(self): 115 | msg = "Checking Robots.txt File ..." 116 | report.verbose(msg) 117 | requester.request(self.url + "/robots.txt", data=None) 118 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 119 | msg = "Robots.txt Found: " + self.url + "/robots.txt" 120 | report.low(msg) 121 | else: 122 | msg = "No Robots.txt Found" 123 | report.low(msg) 124 | 125 | 126 | # Extract error codes and page length from a not existing web page 127 | def NotExistingURL(self): 128 | msg = "Requesting Not Existing Pages ..." 129 | report.verbose(msg) 130 | self.NotExistingPage = self.url + "/N0WayThatYouAreHere" + time.strftime('%d%m%H%M%S') 131 | for commExt in self.commExt: 132 | requester.request(self.NotExistingPage + commExt, data=None) 133 | self.notValidLen.append(len(requester.htmltext)) 134 | self.notExistingCode = requester.status_code 135 | self.notValidLen = sorted(set(self.notValidLen)) 136 | 137 | # Find interesting directories or files via dictionary attack 138 | def CommonFiles(self): 139 | msg = "Checking interesting directories/files ... " 140 | report.message(msg) 141 | self.interFiles = [] 142 | # Create Code 143 | q = queue.Queue() 144 | # Spawn all threads into code 145 | for u in range(self.thread_num): 146 | t = ThreadScanner(self.url, "/", "", self.interFiles, self.notExistingCode, self.notValidLen, q) 147 | t.daemon = True 148 | t.start() 149 | 150 | for extIndex, ext in enumerate(self.commExt): 151 | # Add all plugins to the queue 152 | for commFilesIndex, file in enumerate(self.commFiles): 153 | q.put(file + ext) 154 | sys.stdout.write("\r" + str((100 * ((len(self.commFiles) * extIndex) + commFilesIndex) / 155 | (len(self.commFiles) * len(self.commExt)))) + "% " + file + ext + " ") 156 | sys.stdout.flush() 157 | q.join() 158 | sys.stdout.write("\r") 159 | sys.stdout.flush() 160 | 161 | for file in self.interFiles: 162 | msg = self.url + "/" + file 163 | report.low(msg) 164 | 165 | genericchecker = GenericChecks() 166 | -------------------------------------------------------------------------------- /cmsmap/lib/initialize.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import os, configparser 3 | 4 | class Initialize: 5 | 6 | def __init__(self): 7 | self.url = None 8 | self.netloc = None 9 | self.scheme = None 10 | self.verbose = False 11 | self.default = False 12 | self.BruteForcingAttack = False 13 | self.CrackingPasswords = False 14 | self.FullScan = False 15 | self.NoExploitdb = False 16 | self.disableCleanURLs = False # https://www.drupal.org/docs/8/clean-urls-in-drupal-8 17 | self.cmsmapPath = os.path.join(os.path.dirname(__file__), os.pardir) 18 | self.cmsmapPath = os.path.normpath(os.path.join(os.path.dirname(__file__), os.pardir)) 19 | self.ospath = self.cmsmapPath 20 | self.output = False 21 | self.threads = 5 22 | self.forceCMSmapUpdateType = None 23 | self.forceCMSmapUpdate = False 24 | self.weakpsw = ['password', 'admin', '123456', 'Password1'] 25 | self.config = configparser.ConfigParser() 26 | self.config.read(os.path.join(self.cmsmapPath, "cmsmap.conf")) 27 | self.ParseConfigFile() 28 | 29 | def ParseConfigFile(self): 30 | # General 31 | self.agent = self.config.get("general", "user-agent") 32 | self.headers = {'User-Agent': self.agent} 33 | self.wordlist = os.path.join(self.cmsmapPath, self.config.get("general", "wordlist")) 34 | self.dataPath = os.path.join(self.cmsmapPath, self.config.get("general", "dataPath")) 35 | self.commFiles = os.path.join(self.cmsmapPath, self.config.get("general", "common_files")) 36 | self.confFiles = os.path.join(self.cmsmapPath, self.config.get("general", "conf_extensions")) 37 | 38 | # Wordpress 39 | self.wp_plugins = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_plugins")) 40 | self.wp_plugins_small = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_plugins_small")) 41 | self.wp_themes_small = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_themes_small")) 42 | self.wp_themes = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_themes")) 43 | self.wp_versions = os.path.join(self.cmsmapPath, self.config.get("wordpress","wp_versions")) 44 | self.wp_timthumbs = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_timthumbs")) 45 | self.wp_defaultFiles = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_defaultFiles")) 46 | self.wp_defaultFolders = os.path.join(self.cmsmapPath, self.config.get("wordpress", "wp_defaultFolders")) 47 | # Joomla 48 | self.joo_plugins = os.path.join(self.cmsmapPath, self.config.get("joomla", "joo_plugins")) 49 | self.joo_plugins_small = os.path.join(self.cmsmapPath, self.config.get("joomla", "joo_plugins_small")) 50 | self.joo_defaultFiles = os.path.join(self.cmsmapPath, self.config.get("joomla", "joo_defaultFiles")) 51 | self.joo_defaultFolders = os.path.join(self.cmsmapPath, self.config.get("joomla", "joo_defaultFolders")) 52 | self.joo_versions = os.path.join(self.cmsmapPath, self.config.get("joomla", "joo_versions")) 53 | # Drupal 54 | self.dru_plugins = os.path.join(self.cmsmapPath, self.config.get("drupal", "dru_plugins")) 55 | self.dru_plugins_small = os.path.join(self.cmsmapPath, self.config.get("drupal", "dru_plugins_small")) 56 | self.dru_defaultFiles = os.path.join(self.cmsmapPath, self.config.get("drupal", "dru_defaultFiles")) 57 | self.dru_defaultFolders = os.path.join(self.cmsmapPath, self.config.get("drupal", "dru_defaultFolders")) 58 | self.dru_versions = os.path.join(self.cmsmapPath, self.config.get("drupal", "dru_versions")) 59 | # Moodle 60 | #self.moo_plugins = os.path.join(self.cmsmapPath, self.config.get("moodle", "moo_plugins")) 61 | #self.moo_plugins_small = os.path.join(self.cmsmapPath, self.config.get("moodle", "moo_plugins_small")) 62 | self.moo_defaultFiles = os.path.join(self.cmsmapPath, self.config.get("moodle", "moo_defaultFiles")) 63 | self.moo_defaultFolders = os.path.join(self.cmsmapPath, self.config.get("moodle", "moo_defaultFolders")) 64 | self.moo_versions = os.path.join(self.cmsmapPath, self.config.get("moodle", "moo_versions")) 65 | 66 | # ExploitDB 67 | self.edbtype = self.config.get("exploitdb", "edbtype") 68 | self.edbpath = os.path.join(os.path.normpath(self.config.get("exploitdb", "edbpath")), "") 69 | 70 | 71 | initializer = Initialize() 72 | -------------------------------------------------------------------------------- /cmsmap/lib/jooscan.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import sys, re, queue, time 3 | 4 | # Import Objects 5 | from .initialize import initializer 6 | from .report import report 7 | from .exploitdbsearch import searcher 8 | from .genericchecks import genericchecker 9 | from .bruteforcer import bruter 10 | from .requester import requester 11 | 12 | # Import Class 13 | from .threadscanner import ThreadScanner 14 | 15 | 16 | class JooScan: 17 | # Scan Joomla site 18 | def __init__(self): 19 | self.url = None 20 | self.usernames = [] 21 | self.pluginPath = "?option=" 22 | self.pluginsFound = [] 23 | self.notValidLen = [] 24 | self.notExistingCode = 404 25 | self.confFiles = [line.strip() for line in open(initializer.confFiles)] 26 | self.excludeEDBPlugins = [] 27 | self.excludeEDBPlugins = ['system', 'com_banners', 'com_contact', 'com_content', 'com_users'] 28 | self.plugins = [line.strip() for line in open(initializer.joo_plugins)] 29 | 30 | # Joomla checks 31 | def Joorun(self): 32 | msg = "CMS Detection: Joomla" 33 | report.info(msg) 34 | searcher.cmstype = "Joomla" 35 | searcher.pluginPath = self.pluginPath 36 | searcher.exclude = self.excludeEDBPlugins 37 | self.JooGetLocalFiles() 38 | self.JooVersion() 39 | self.JooTemplate() 40 | self.JooConfigFiles() 41 | self.JooFeed() 42 | bruter.usrlist = self.usernames 43 | bruter.pswlist = initializer.weakpsw 44 | if bruter.dictattack is not None: bruter.Joorun() 45 | genericchecker.AutocompleteOff('/administrator/index.php') 46 | self.JooDefaultFiles() 47 | if initializer.FullScan: genericchecker.CommonFiles() 48 | self.JooModulesIndex() 49 | self.JooComponents() 50 | if not initializer.FullScan: searcher.exclude = self.excludeEDBPlugins 51 | self.JooComponentsVersion() 52 | searcher.query = self.pluginsFound 53 | searcher.OfflinePlugins() 54 | self.JooDirsListing() 55 | 56 | # Grab the small plugins, versions and default files generated at run time 57 | def JooGetLocalFiles(self): 58 | self.plugins_small = [line.strip() for line in open(initializer.joo_plugins_small)] 59 | self.versions = [line.strip() for line in open(initializer.joo_versions)] 60 | self.defaultFiles = [line.strip() for line in open(initializer.joo_defaultFiles)] 61 | self.defaultFolders = [line.strip() for line in open(initializer.joo_defaultFolders)] 62 | 63 | # Find Joomla version and check it on exploit-db 64 | def JooVersion(self): 65 | msg = "Checking Joomla version ..." 66 | report.verbose(msg) 67 | requester.request(self.url + "/administrator/manifests/files" + '/joomla.xml', data=None) 68 | regex = '(.+?)' 69 | pattern = re.compile(regex) 70 | version = re.findall(pattern, requester.htmltext) 71 | if version: 72 | msg = "Joomla Version: " + version[0] 73 | report.info(msg) 74 | if version[0] in self.versions: 75 | for ver in self.versions: 76 | searcher.query = ver 77 | searcher.OfflineCore() 78 | if ver == version[0]: 79 | break 80 | 81 | # Find current Joomla templates and check them on exploit-db 82 | def JooTemplate(self): 83 | msg = "Checking Joomla template ..." 84 | report.verbose(msg) 85 | requester.request(self.url + '/index.php', data=None) 86 | WebTemplates = re.findall("/templates/(.+?)/", requester.htmltext,re.IGNORECASE) 87 | WebTemplates = sorted(set(WebTemplates)) 88 | requester.request(self.url + '/administrator/index.php', data=None) 89 | AdminTemplates = re.findall("/administrator/templates/(.+?)/", requester.htmltext, re.IGNORECASE) 90 | AdminTemplates = sorted(set(AdminTemplates)) 91 | if WebTemplates: 92 | for WebTemplate in WebTemplates: 93 | msg = "Joomla Website Template: " + WebTemplate 94 | report.info(msg) 95 | searcher.query = WebTemplate 96 | searcher.OfflineTheme() 97 | if AdminTemplates: 98 | for AdminTemplate in AdminTemplates: 99 | msg = "Joomla Administrator Template: " + AdminTemplate 100 | report.info(msg) 101 | searcher.query = AdminTemplate 102 | searcher.OfflineTheme() 103 | 104 | # Find old or temp Joomla config files left on the web root 105 | def JooConfigFiles(self): 106 | msg = "Checking Joomla old configuration files ..." 107 | report.verbose(msg) 108 | for file in self.confFiles: 109 | requester.request(self.url + "/configuration" + file, data=None) 110 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 111 | msg = "Configuration File Found: " + self.url + "/configuration" + file 112 | report.high(msg) 113 | 114 | # Find default Joomla files (large number, prompt the user if display them all) 115 | def JooDefaultFiles(self): 116 | self.defFilesFound = [] 117 | msg = "Checking Joomla default files ..." 118 | report.verbose(msg) 119 | msg = "Joomla Default Files: " 120 | report.message(msg) 121 | msg = "Joomla is likely to have a large number of default files" 122 | report.message(msg) 123 | msg = "Would you like to list them all?" 124 | report.message(msg) 125 | if not initializer.default: 126 | if input("[y/N]: ").lower().startswith('y'): 127 | # Check for default files 128 | for r, file in enumerate(self.defaultFiles): 129 | requester.request(self.url + file, data=None) 130 | sys.stdout.write("\r" + str(int(100 * int(r + 1) / len(self.defaultFiles))) + "%") 131 | sys.stdout.flush() 132 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 133 | self.defFilesFound.append(self.url + file) 134 | sys.stdout.write("\r") 135 | for file in self.defFilesFound: 136 | msg = file 137 | report.info(msg) 138 | 139 | # Find Joomla users via Feed (Feed is available only in old versions of Joomla) 140 | def JooFeed(self): 141 | requester.request(self.url + '/?format=feed', data=None) 142 | jooUsers = re.findall("(.+?) \((.+?)\)", requester.htmltext, re.IGNORECASE) 143 | if jooUsers: 144 | msg = "Enumerating Joomla Usernames via \"Feed\" ..." 145 | report.message(msg) 146 | jooUsers = sorted(set(jooUsers)) 147 | for user in jooUsers: 148 | self.usernames.append(user[1]) 149 | msg = user[1] + ": " + user[0] 150 | report.info(msg) 151 | 152 | # Find directory listing in default directories and components directories 153 | def JooDirsListing(self): 154 | msg = "Checking for Directory Listing Enabled ..." 155 | report.info(msg) 156 | report.WriteTextFile(msg) 157 | for folder in self.defaultFolders: 158 | genericchecker.DirectoryListing(folder) 159 | for plugin in self.pluginsFound: 160 | genericchecker.DirectoryListing('/components/' + plugin) 161 | 162 | # Find modules checking the source code of the main page 163 | def JooModulesIndex(self): 164 | msg = "Checking Joomla modules in the index page" 165 | report.verbose(msg) 166 | requester.request(self.url, data=None) 167 | self.pluginsFound = re.findall( 168 | re.compile('/modules/(.+?)/'), requester.htmltext) 169 | self.pluginsFound = sorted(set(self.pluginsFound)) 170 | 171 | # Template to find plugins version 172 | # Convert JooPluginsFound in a dictionary 173 | def JooComponentsVersion(self): 174 | self.pluginsFoundVers = {} 175 | for pluginFound in self.pluginsFound: 176 | self.pluginsFoundVers[pluginFound] = None 177 | self.pluginsFound = self.pluginsFoundVers 178 | 179 | # Find components via dictionary attack 180 | def JooComponents(self): 181 | msg = "Searching Joomla Components ..." 182 | report.message(msg) 183 | if not initializer.FullScan: self.plugins = self.plugins_small 184 | # Create Code 185 | q = queue.Queue() 186 | # Spawn all threads into code 187 | for u in range(initializer.threads): 188 | t = ThreadScanner(self.url, self.pluginPath, "/", self.pluginsFound, self.notExistingCode, self.notValidLen, q) 189 | t.daemon = True 190 | t.start() 191 | # Add all plugins to the queue 192 | for r, i in enumerate(self.plugins): 193 | q.put(i) 194 | while not q.empty() : 195 | sys.stdout.write("\r"+str(int((len(self.plugins) - q.qsize()) * 100 / len(self.plugins))) + "%") 196 | sys.stdout.flush() 197 | time.sleep(1) 198 | q.join() 199 | sys.stdout.write("\r") 200 | 201 | 202 | jooscan = JooScan() 203 | -------------------------------------------------------------------------------- /cmsmap/lib/mooscan.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import sys, re, hashlib, subprocess, os 3 | 4 | # Import Objects 5 | from .initialize import initializer 6 | from .report import report 7 | from .exploitdbsearch import searcher 8 | from .genericchecks import genericchecker 9 | from .bruteforcer import bruter 10 | from .requester import requester 11 | 12 | 13 | # Import Class 14 | from .threadscanner import ThreadScanner 15 | 16 | 17 | class MooScan: 18 | # Scan Moodle site 19 | def __init__(self): 20 | self.url = None 21 | self.usernames = [] 22 | # Plugins can be in /local /blocks /mod 23 | self.pluginPath = "/local" 24 | self.pluginsFound = [] 25 | self.notValidLen = [] 26 | self.notExistingCode = 404 27 | self.confFiles = [line.strip() for line in open(initializer.confFiles)] 28 | # No plugins for moodle 29 | #self.plugins = [line.strip() for line in open(initializer.moo_plugins)] 30 | 31 | # Moodle checks 32 | def Moorun(self): 33 | msg = "CMS Detection: Moodle" 34 | report.info(msg) 35 | searcher.cmstype = "Moodle" 36 | searcher.pluginPath = self.pluginPath 37 | self.MooGetLocalFiles() 38 | self.MooConfigFiles() 39 | self.MooDefaultFiles() 40 | self.MooVersion() 41 | self.MooDirsListing() 42 | 43 | # Grab the versions and default files generated at run time 44 | def MooGetLocalFiles(self): 45 | self.versions = [line.strip() for line in open(initializer.moo_versions)] 46 | self.defaultFiles = [line.strip() for line in open(initializer.moo_defaultFiles)] 47 | self.defaultFolders = [line.strip() for line in open(initializer.moo_defaultFolders)] 48 | 49 | # Find old or temp Moodle config files left on the web root 50 | def MooConfigFiles(self): 51 | msg = "Checking Moodle old configuration files ..." 52 | report.verbose(msg) 53 | for file in self.confFiles: 54 | requester.request(self.url + "/config" + file, data=None) 55 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 56 | msg = "Configuration File Found: " + self.url + "/config" + file 57 | report.high(msg) 58 | 59 | # Find default Moodle files (large number, prompt the user if display them all) 60 | def MooDefaultFiles(self): 61 | self.defFilesFound = [] 62 | msg = "Checking Moodle default files ..." 63 | report.verbose(msg) 64 | msg = "Moodle Default Files: " 65 | report.message(msg) 66 | msg = "Moodle is likely to have a large number of default files" 67 | report.message(msg) 68 | msg = "Would you like to list them all?" 69 | report.message(msg) 70 | if not initializer.default: 71 | if input("[y/N]: ").lower().startswith('y'): 72 | # Check for default files 73 | for r, file in enumerate(self.defaultFiles): 74 | requester.request(self.url + file, data=None) 75 | sys.stdout.write("\r" + str(int(100 * int(r + 1) / len(self.defaultFiles))) + "%") 76 | sys.stdout.flush() 77 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 78 | self.defFilesFound.append(file) 79 | sys.stdout.write("\r") 80 | for file in self.defFilesFound: 81 | msg = self.url + file 82 | report.info(msg) 83 | 84 | # Find Moodle version 85 | def MooVersion(self): 86 | # Check if self.defFilesFound is not empty 87 | if self.defFilesFound : 88 | defFileHashes = {} 89 | top3 = 0 90 | top3versions = [] 91 | firstmatch = False 92 | # Create list of Moodle versions {('version': hash_value)} 93 | for defFile in self.defFilesFound : 94 | requester.request(self.url + defFile, data=None) 95 | hash_object = hashlib.sha256(requester.htmltext.encode('utf-8')) 96 | hash_digest = hash_object.hexdigest() 97 | defFileHashes[defFile]=hash_digest 98 | msg = "Checking Moodle version ..." 99 | report.verbose(msg) 100 | FNULL = open(os.devnull, 'w') 101 | p = subprocess.Popen("git -C "+ initializer.cmsmapPath+"/tmp/moodle checkout master -f", stdout=FNULL, stderr=FNULL, shell=True) 102 | p.communicate() 103 | # Compare discovered default files with default files against each version of Moodle 104 | for mver in self.versions : 105 | msg = "Checking version: "+ mver 106 | report.verbose(msg) 107 | matches = 0 108 | p = subprocess.Popen("git -C "+ initializer.cmsmapPath+"/tmp/moodle checkout tags/"+mver, stdout=FNULL, stderr=FNULL, shell=True) 109 | p.communicate() 110 | for defFile, defFileHash in defFileHashes.items() : 111 | filepath = initializer.cmsmapPath+"/tmp/moodle"+defFile 112 | if os.path.isfile(filepath): 113 | f = open(filepath, "rb") 114 | hash_object = hashlib.sha256(f.read()) 115 | hash_digest = hash_object.hexdigest() 116 | if hash_digest == defFileHash : 117 | matches = matches + 1 118 | # Margin error of 1 file 119 | if matches >= (len(defFileHashes)-1) : 120 | top3versions.append((mver,matches)) 121 | firstmatch = True 122 | if firstmatch : 123 | top3 = top3 + 1 124 | if top3 == 3 : 125 | top3versions = sorted(top3versions, key=lambda ver: ver[1], reverse=True) 126 | msg = "Detected version of Moodle appears to be: " 127 | report.info(msg) 128 | for moodle_vers in top3versions : 129 | msg = str(moodle_vers[0]) 130 | report.info(msg) 131 | break 132 | 133 | p = subprocess.Popen("git -C "+ initializer.cmsmapPath+"/tmp/moodle checkout master -f", stdout=FNULL, stderr=FNULL, shell=True, universal_newlines=True) 134 | output, error = p.communicate() 135 | 136 | # Find directory listing in default directories and components directories 137 | def MooDirsListing(self): 138 | msg = "Checking for Directory Listing Enabled ..." 139 | report.info(msg) 140 | report.WriteTextFile(msg) 141 | for folder in self.defaultFolders: 142 | genericchecker.DirectoryListing(folder) 143 | 144 | mooscan = MooScan() 145 | -------------------------------------------------------------------------------- /cmsmap/lib/postexploit.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import os 3 | 4 | # Import Object 5 | from .report import report 6 | 7 | 8 | class PostExploit: 9 | # Perform post exploitation attacks 10 | def __init__(self): 11 | pass 12 | 13 | # Determine type of hash based on length and call the appropriate function 14 | def CrackingHashesType(self, hashfile, wordlist): 15 | self.hashfile = hashfile 16 | self.wordlist = wordlist 17 | for hashpsw in [line.strip() for line in open(hashfile)]: 18 | if len(hashpsw) == 34: 19 | self.WPCrackHashes() 20 | break 21 | elif len(hashpsw) == 65: 22 | self.JooCrackHashes() 23 | break 24 | else: 25 | msg = "No Valid Password Hash: " + hashpsw 26 | report.error(msg) 27 | 28 | # Run hashcat to crack WordPress hashes 29 | def WPCrackHashes(self): 30 | # hashcat -m 400 -a 0 -o cracked.txt hashes.txt passw.txt 31 | msg = "Cracking WordPress Hashes in: " + self.hashfile + " ... " 32 | report.verbose(msg) 33 | process = os.system("hashcat -m 400 -a 0 -o cracked.txt " + 34 | self.hashfile + " " + self.wordlist) 35 | if process == 0: 36 | msg = "Cracked Passwords saved in: cracked.txt" 37 | report.info(msg) 38 | else: 39 | msg = "Cracking could not be completed. Please install hashcat: http://hashcat.net/" 40 | report.error(msg) 41 | 42 | # Run hashcat to crack Joomla hashes 43 | def JooCrackHashes(self): 44 | # hashcat -m 10 -a 0 -o cracked.txt hashes.txt passw.txt 45 | msg = "Cracking Joomla Hashes in: " + self.hashfile + " ... " 46 | report.verbose(msg) 47 | process = os.system("hashcat -m 10 -a 0 -o cracked.txt " + self.hashfile 48 | + " " + self.wordlist) 49 | if process == 0: 50 | msg = "Cracked Passwords saved in: cracked.txt" 51 | report.info(msg) 52 | else: 53 | msg = "Cracking could not be completed. Please install hashcat: http://hashcat.net/" 54 | report.error(msg) 55 | 56 | 57 | postexploiter = PostExploit() 58 | -------------------------------------------------------------------------------- /cmsmap/lib/report.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | import os, sys, platform 3 | 4 | from .initialize import initializer 5 | 6 | 7 | class Report: 8 | 9 | def __init__(self): 10 | self.fn = "" 11 | self.log = ' '.join(sys.argv) 12 | self.col() 13 | 14 | def col(self): 15 | if sys.stdout.isatty() and platform.system() != "Windows": 16 | self.green = '\033[32m' 17 | self.blue = '\033[94m' 18 | self.red = '\033[31m' 19 | self.brown = '\033[33m' 20 | self.grey = '\033[90m' 21 | self.orange = '\033[38;5;208m' 22 | self.yellow = '\033[93m' 23 | self.end = '\033[0m' 24 | 25 | else: # Disalbing col for windows and pipes 26 | self.green = "" 27 | self.orange = "" 28 | self.blue = "" 29 | self.red = "" 30 | self.brown = "" 31 | self.grey = "" 32 | self.yellow = "" 33 | self.end = "" 34 | 35 | def info(self, msg): 36 | self.WriteTextFile("[I] " + msg) 37 | msg = self.green + "[I] " + self.end + msg 38 | print(msg) 39 | 40 | def low(self, msg): 41 | self.WriteTextFile("[L] " + msg) 42 | msg = self.yellow + "[L] " + self.end + msg 43 | print(msg) 44 | 45 | def medium(self, msg): 46 | self.WriteTextFile("[M] " + msg) 47 | msg = self.orange + "[M] " + self.end + msg 48 | print(msg) 49 | 50 | def high(self, msg): 51 | self.WriteTextFile("[H] " + msg) 52 | msg = self.red + "[H] " + self.end + msg 53 | print(msg) 54 | 55 | def status(self, msg): 56 | self.WriteTextFile("[-] " + msg) 57 | msg = self.blue + "[-] " + self.end + msg 58 | print(msg) 59 | 60 | def message(self, msg): 61 | msg = "[-] " + msg 62 | print(msg) 63 | self.WriteTextFile(msg) 64 | 65 | def error(self, msg): 66 | self.WriteTextFile("[ERROR] " + msg) 67 | msg = self.red + "[ERROR] " + self.end + msg 68 | print(msg) 69 | 70 | def verbose(self, msg): 71 | if initializer.verbose: 72 | self.WriteTextFile("[v] " + msg) 73 | msg = self.grey + "[v] " + self.end + msg 74 | print(msg) 75 | 76 | def WriteTextFile(self, msg): 77 | if initializer.output: 78 | self.log += "\n" + msg 79 | f = open(os.path.join(os.getcwd(), self.fn), "w") 80 | f.write(self.log) 81 | f.close() 82 | 83 | def WriteHTMLFile(self): 84 | pass 85 | 86 | 87 | report = Report() 88 | -------------------------------------------------------------------------------- /cmsmap/lib/requester.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import urllib, ssl, http.cookiejar 3 | 4 | # Import Objects 5 | from .initialize import initializer 6 | 7 | class Requester: 8 | def __init__(self): 9 | self.htmltext = None 10 | self.status_code = None 11 | self.headers = initializer.headers 12 | self.ctx = ssl.create_default_context() 13 | self.ctx.check_hostname = False 14 | self.ctx.verify_mode = ssl.CERT_NONE 15 | self.cookieJar = http.cookiejar.CookieJar() 16 | self.cookieHandler = urllib.request.HTTPCookieProcessor(self.cookieJar) 17 | 18 | def request(self, url, data): 19 | self.url = url 20 | self.data = data 21 | if type(data) is dict: 22 | data = urllib.parse.urlencode(data) 23 | if data : data = data.encode('utf-8') 24 | self.req = urllib.request.Request(url=url, data=data, headers=self.headers) 25 | urllib.request.install_opener(urllib.request.build_opener()) 26 | try: 27 | # Returns 200 28 | if initializer.nosslcheck : 29 | self.response = urllib.request.urlopen(self.req, context=self.ctx) 30 | else: 31 | self.response = urllib.request.urlopen(self.req) 32 | # it will ignore any bad character without replacing it 33 | self.htmltext = self.response.read().decode('utf-8', 'ignore') 34 | self.status_code = 200 35 | except urllib.request.HTTPError as e: 36 | # Does not return 200 37 | self.response = e 38 | self.htmltext = e.read().decode('utf-8', 'ignore') 39 | self.status_code = e.code 40 | 41 | def noredirect(self, url, data): 42 | self.url = url 43 | self.data = data 44 | if type(data) is dict: 45 | data = urllib.parse.urlencode(data) 46 | if data : data = data.encode('utf-8') 47 | self.req = urllib.request.Request(url=url, data=data, headers=self.headers) 48 | urllib.request.install_opener(urllib.request.build_opener(NoRedirects())) 49 | try: 50 | # Returns 200 51 | if initializer.nosslcheck : 52 | self.response = urllib.request.urlopen(self.req, context=self.ctx) 53 | else: 54 | self.response = urllib.request.urlopen(self.req) 55 | self.htmltext = self.response.read().decode('utf-8', 'ignore') 56 | self.status_code = 200 57 | except urllib.request.HTTPError as e: 58 | # Does not return 200 59 | self.response = e 60 | self.htmltext = e.read().decode('utf-8', 'ignore') 61 | self.status_code = e.code 62 | 63 | def requestcookie(self, url, data): 64 | self.url = url 65 | self.data = data 66 | if type(data) is dict: 67 | data = urllib.parse.urlencode(data) 68 | if data : data = data.encode('utf-8') 69 | self.req = urllib.request.Request(url=url, data=data, headers=self.headers) 70 | urllib.request.install_opener(urllib.request.build_opener(self.cookieHandler)) 71 | try: 72 | # Returns 200 73 | if initializer.nosslcheck : 74 | self.response = urllib.request.urlopen(self.req, context=self.ctx) 75 | else: 76 | self.response = urllib.request.urlopen(self.req) 77 | # it will ignore any bad character without replacing it 78 | self.htmltext = self.response.read().decode('utf-8', 'ignore') 79 | self.status_code = 200 80 | except urllib.request.HTTPError as e: 81 | # Does not return 200 82 | self.response = e 83 | self.htmltext = e.read().decode('utf-8', 'ignore') 84 | self.status_code = e.code 85 | 86 | class NoRedirects(urllib.request.HTTPRedirectHandler): 87 | # Redirect handler that simply raises a Redirect() for all http_error_30*() methods 88 | def redirect_request(self, req, fp, code, msg, headers, newurl): 89 | RedirError = urllib.request.HTTPError(req.get_full_url(), code, msg, headers, fp) 90 | RedirError.status = code 91 | raise RedirError 92 | 93 | requester = Requester() 94 | -------------------------------------------------------------------------------- /cmsmap/lib/scanner.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import sys 3 | 4 | # Import Objects 5 | from urllib.parse import urlparse 6 | from .initialize import initializer 7 | from .wpscan import wpscan 8 | from .jooscan import jooscan 9 | from .druscan import druscan 10 | from .mooscan import mooscan 11 | from .report import report 12 | from .genericchecks import genericchecker 13 | from .requester import requester 14 | from .bruteforcer import bruter 15 | 16 | 17 | class Scanner: 18 | # Main class for scanning the website 19 | def __init__(self): 20 | self.headers = initializer.headers 21 | self.url = None 22 | self.force = None 23 | self.file = None 24 | self.notExistingCode = 404 25 | self.notValidLen = [] 26 | 27 | # Execute some initial checks and then attempt to identify the type of CMS 28 | def RunScanner(self): 29 | wpscan.url = jooscan.url = druscan.url = mooscan.url = initializer.url 30 | genericchecker.CheckURL() 31 | genericchecker.NotExistingURL() 32 | wpscan.notExistingCode = jooscan.notExistingCode = druscan.notExistingCode = genericchecker.notExistingCode 33 | wpscan.notValidLen = jooscan.notValidLen = druscan.notValidLen = genericchecker.notValidLen 34 | genericchecker.HTTPSCheck() 35 | genericchecker.HeadersCheck() 36 | genericchecker.RobotsTXT() 37 | if self.force is None: 38 | self.FindCMSType() 39 | else: 40 | self.ForceCMSType() 41 | 42 | # Force the execution of the scan based on the user's input 43 | def ForceCMSType(self): 44 | if self.force == 'W': 45 | if initializer.BruteForcingAttack : 46 | bruter.force = 'W' 47 | bruter.Start() 48 | else : 49 | wpscan.WPrun() 50 | elif self.force == 'J': 51 | if initializer.BruteForcingAttack : 52 | bruter.force = 'J' 53 | bruter.Start() 54 | else : 55 | jooscan.Joorun() 56 | elif self.force == 'D': 57 | if initializer.BruteForcingAttack : 58 | bruter.force = 'D' 59 | bruter.Start() 60 | else : 61 | druscan.Drurun() 62 | elif self.force == 'M': 63 | mooscan.Moorun() 64 | else: 65 | msg = "Not Valid Option Provided: use (W)ordpress, (J)oomla, (D)rupal" 66 | report.error(msg) 67 | sys.exit(1) 68 | 69 | # Attempt to identify the type of CMS based on the configuration file 70 | def FindCMSType(self): 71 | msg = "Detecting type of CMS ..." 72 | report.verbose(msg) 73 | if self.force is None: 74 | requester.request(self.url+ "/wp-config.php", data=None) 75 | if (requester.status_code == 403 or 76 | requester.status_code == 200) and len(requester.htmltext) not in self.notValidLen and self.force is None: 77 | self.force = 'W' 78 | else: 79 | msg = "WordPress Config File Not Found: " + self.url + "/wp-config.php" 80 | report.verbose(msg) 81 | # Joomla 82 | requester.request(self.url+ "/configuration.php", data=None) 83 | if (requester.status_code == 403 or 84 | requester.status_code == 200) and len(requester.htmltext) not in self.notValidLen and self.force is None: 85 | self.force = 'J' 86 | else: 87 | msg = "Joomla Config File Not Found: " + self.url + "/configuration.php" 88 | report.verbose(msg) 89 | # Drupal 90 | requester.request(self.url+ "/sites/default/settings.php", data=None) 91 | if (requester.status_code == 403 or 92 | requester.status_code == 200) and len(requester.htmltext) not in self.notValidLen and self.force is None: 93 | self.force = 'D' 94 | pUrl = urlparse(self.url) 95 | netloc = pUrl.netloc.lower() 96 | requester.request(self.url + "/sites/" + netloc + "/settings.php", data=None) 97 | if (requester.status_code == 403 or 98 | requester.status_code == 200) and len(requester.htmltext) not in self.notValidLen and self.force is None: 99 | self.force = 'D' 100 | else: 101 | msg = "Drupal Config File Not Found: " + self.url + "/sites/default/settings.php" 102 | report.verbose(msg) 103 | # Moodle 104 | requester.request(self.url+ "/config.php", data=None) 105 | if (requester.status_code == 403 or 106 | requester.status_code == 200) and len(requester.htmltext) not in self.notValidLen and self.force is None: 107 | self.force = 'M' 108 | else: 109 | msg = "Moodle Config File Not Found: " + self.url + "/config.php" 110 | report.verbose(msg) 111 | # CMS Detection has failed 112 | if self.force is None: 113 | msg = "CMS detection failed :(" 114 | report.error(msg) 115 | msg = "Use -f to force CMSmap to scan (W)ordpress, (J)oomla or (D)rupal" 116 | report.error(msg) 117 | sys.exit(1) 118 | else: 119 | self.ForceCMSType() 120 | else: 121 | msg = "CMSmap forced to scan: " + self.force 122 | report.verbose(msg) 123 | 124 | scanner = Scanner() 125 | -------------------------------------------------------------------------------- /cmsmap/lib/threadscanner.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import urllib, http.client, threading, time, socket 3 | 4 | # Import Object 5 | from .initialize import initializer 6 | from .report import report 7 | from .requester import requester 8 | 9 | 10 | class ThreadScanner(threading.Thread): 11 | # Implements Multi-Threads 12 | # self.url = http://mysite.com 13 | # pluginPath = /wp-content 14 | # pluginPathEnd = / 15 | # pluginFound = wptest 16 | def __init__(self, url, pluginPath, pluginPathEnd, pluginsFound, notExistingCode, notValidLen, q): 17 | threading.Thread.__init__(self) 18 | self.url = url 19 | self.q = q 20 | self.pluginPath = pluginPath 21 | self.pluginsFound = pluginsFound 22 | self.pluginPathEnd = pluginPathEnd 23 | self.notExistingCode = notExistingCode 24 | self.notValidLen = notValidLen 25 | 26 | def run(self): 27 | while True: 28 | # Get plugin from plugin queue 29 | plugin = self.q.get() 30 | requester.request(self.url + self.pluginPath + plugin + self.pluginPathEnd, data=None) 31 | if requester.status_code == 200 and len(requester.htmltext) not in self.notValidLen: 32 | self.pluginsFound.append(plugin) 33 | elif requester.status_code != self.notExistingCode and len(requester.htmltext) not in self.notValidLen: 34 | self.pluginsFound.append(plugin) 35 | self.q.task_done() 36 | 37 | # Used by BruteForcer. Then can be deleted 38 | class MyResponse(http.client.HTTPResponse): 39 | # Reads responds for no redirection requests 40 | def read(self, amt=None): 41 | self.length = None 42 | return http.client.HTTPResponse.read(self, amt) 43 | 44 | # Used by BruteForcer. Then can be deleted 45 | class MyHandler(urllib.request.HTTPHandler): 46 | def do_open(self, http_class, req): 47 | h = http.client.HTTPConnection 48 | h.response_class = MyResponse 49 | return urllib.request.HTTPHandler.do_open(self, h, req) 50 | -------------------------------------------------------------------------------- /cmsmap/lib/wpscan.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | import sys, re, queue, time 3 | 4 | # Import Object 5 | from .initialize import initializer 6 | from .report import report 7 | from .exploitdbsearch import searcher 8 | from .bruteforcer import bruter 9 | from .genericchecks import genericchecker 10 | from .requester import requester 11 | 12 | # Import Class 13 | from .threadscanner import ThreadScanner 14 | 15 | class WPScan: 16 | # Scan WordPress site 17 | def __init__(self): 18 | self.url = None 19 | self.currentVer = None 20 | self.latestVer = None 21 | self.pluginPath = "/wp-content/plugins/" 22 | self.themePath = "/wp-content/themes/" 23 | self.feed = "/?feed=rss2" 24 | self.author = "/?author=" 25 | self.forgottenPsw = "/wp-login.php?action=lostpassword" 26 | self.usernames = [] 27 | self.pluginsFound = [] 28 | self.timthumbsFound = [] 29 | self.notValidLen = [] 30 | self.XMLRPCEnable = True 31 | self.theme = None 32 | self.notExistingCode = 404 33 | self.confFiles = [line.strip() for line in open(initializer.confFiles)] 34 | self.plugins = [line.strip() for line in open(initializer.wp_plugins)] 35 | self.themes = [line.strip() for line in open(initializer.wp_themes)] 36 | self.themes_small = [line.strip() for line in open(initializer.wp_themes_small)] 37 | self.timthumbs = [line.strip() for line in open(initializer.wp_timthumbs)] 38 | 39 | # WordPress checks 40 | def WPrun(self): 41 | msg = "CMS Detection: WordPress" 42 | report.info(msg) 43 | searcher.cmstype = "Wordpress" 44 | searcher.pluginPath = self.pluginPath 45 | self.WPGetLocalFiles() 46 | self.WPVersion() 47 | self.WPCurrentTheme() 48 | self.WPConfigFiles() 49 | self.WPHello() 50 | self.WPFeed() 51 | self.WPAuthor() 52 | bruter.usrlist = self.usernames 53 | bruter.pswlist = initializer.weakpsw 54 | self.WPXMLRPC_check() 55 | if self.XMLRPCEnable: 56 | if bruter.dictattack is not None: bruter.WPXMLRPC_brute() 57 | self.WPXMLRPC_pingback() 58 | self.WPXMLRPC_BF() 59 | elif bruter.dictattack is not None: 60 | bruter.WPrun() 61 | self.WPForgottenPassword() 62 | genericchecker.AutocompleteOff('/wp-login.php') 63 | self.WPDefaultFiles() 64 | if initializer.FullScan: genericchecker.CommonFiles() 65 | self.WPpluginsIndex() 66 | self.WPplugins() 67 | self.WPpluginsVersion() 68 | searcher.query = self.pluginsFound 69 | searcher.OfflinePlugins() 70 | if initializer.FullScan: self.WPTimThumbs() 71 | self.WPDirsListing() 72 | 73 | # Grab the small plugins, versions and default files generated at run time 74 | def WPGetLocalFiles(self): 75 | self.plugins_small = [line.strip() for line in open(initializer.wp_plugins_small)] 76 | self.versions = [line.strip() for line in open(initializer.wp_versions)] 77 | self.defaultFiles = [line.strip() for line in open(initializer.wp_defaultFiles)] 78 | self.defaultFolders = [line.strip() for line in open(initializer.wp_defaultFolders)] 79 | 80 | # Find WordPress version and check it on exploit-db 81 | def WPVersion(self): 82 | msg = "Checking WordPress version ..." 83 | report.verbose(msg) 84 | requester.request(self.url + '/readme.html', data=None) 85 | regex = '
.* (\d+\.\d+[\.\d+]*)\n' 86 | pattern = re.compile(regex) 87 | self.currentVer = re.findall(pattern, requester.htmltext) 88 | if self.currentVer: 89 | msg = "Wordpress Version: " + self.currentVer[0] 90 | report.info(msg) 91 | else: 92 | requester.request(self.url, data=None) 93 | self.currentVer = re.findall('[]*", 151 | requester.htmltext) 152 | if wpUsers: 153 | self.usernames = wpUsers + self.usernames 154 | self.usernames = sorted(set(self.usernames)) 155 | 156 | # Find WordPress users checking the first 50 authors blogs 157 | def WPAuthor(self): 158 | msg = "Enumerating Wordpress usernames via \"Author\" ..." 159 | report.verbose(msg) 160 | for user in range(1, 50): 161 | requester.request(self.url + self.author + str(user), data=None) 162 | wpUser = re.findall("author author-(.+?) ", requester.htmltext, re.IGNORECASE) 163 | if wpUser: self.usernames = wpUser + self.usernames 164 | wpUser = re.findall("Posts by (.+?) Feed", requester.htmltext, re.IGNORECASE) 165 | if wpUser: self.usernames = wpUser + self.usernames 166 | self.usernames = sorted(set(self.usernames)) 167 | # if users are found, print them (it includes the users found by WPFeed) 168 | if self.usernames: 169 | msg = "WordPress usernames identified: " 170 | report.message(msg) 171 | for user in self.usernames: 172 | msg = user 173 | report.medium(msg) 174 | 175 | # Check it is possible to enumerate users via Forgotten password functionality 176 | def WPForgottenPassword(self): 177 | msg = "Checking WordPress forgotten password ..." 178 | report.verbose(msg) 179 | # Use an invalid, not-existing, not-registered user 180 | self.postdata = {"user_login": "N0t3xist!1234"} 181 | requester.request(self.url + self.forgottenPsw, data=self.postdata) 182 | if re.findall(re.compile('Invalid username'), requester.htmltext): 183 | msg = "Forgotten Password Allows Username Enumeration: " + self.url + self.forgottenPsw 184 | report.info(msg) 185 | 186 | # Find full path via the default hello plugin 187 | def WPHello(self): 188 | requester.request(self.url + "/wp-content/plugins/hello.php", data=None) 189 | fullPath = re.findall(re.compile('Fatal error.*>/(.+?/)hello.php'), requester.htmltext) 190 | if fullPath: 191 | msg = "Wordpress Hello Plugin Full Path Disclosure: " + "/" + fullPath[0] + "hello.php" 192 | report.low(msg) 193 | 194 | # Find directory listing in default directories and plugin directories 195 | def WPDirsListing(self): 196 | msg = "Checking for Directory Listing Enabled ..." 197 | report.info(msg) 198 | report.WriteTextFile(msg) 199 | for folder in self.defaultFolders: 200 | genericchecker.DirectoryListing(folder) 201 | if self.theme: 202 | genericchecker.DirectoryListing('/wp-content/themes/' + self.theme) 203 | for plugin in self.pluginsFound: 204 | genericchecker.DirectoryListing('/wp-content/plugins/' + plugin) 205 | 206 | # Find plugins checking the source code of the main page 207 | def WPpluginsIndex(self): 208 | msg = "Checking WordPress plugins in the index page" 209 | report.verbose(msg) 210 | requester.request(self.url, data=None) 211 | self.pluginsFound = re.findall(re.compile('/wp-content/plugins/(.+?)/'), requester.htmltext) 212 | 213 | # Find plugins via a dictionary attack 214 | def WPplugins(self): 215 | msg = "Searching Wordpress Plugins ..." 216 | report.message(msg) 217 | if not initializer.FullScan: self.plugins = self.plugins_small 218 | # Create Code 219 | q = queue.Queue() 220 | # Spawn all threads into code 221 | for u in range(initializer.threads): 222 | t = ThreadScanner(self.url, self.pluginPath, "/", self.pluginsFound, self.notExistingCode, self.notValidLen, q) 223 | t.daemon = True 224 | t.start() 225 | # Add all plugins to the queue 226 | for i in self.plugins: 227 | q.put(i) 228 | while not q.empty() : 229 | sys.stdout.write("\r"+str(int((len(self.plugins) - q.qsize()) * 1.0 / len(self.plugins) * 100)) + "%") 230 | sys.stdout.flush() 231 | time.sleep(1) 232 | q.join() 233 | sys.stdout.write("\r") 234 | self.pluginsFound = sorted(set(self.pluginsFound)) 235 | 236 | # self.pluginsFound are now a dictionary {"plugin_name":"plugin_version"} 237 | # Attempt to find plugins version 238 | def WPpluginsVersion(self): 239 | self.pluginsFoundVers = {} 240 | for pluginFound in self.pluginsFound: 241 | requester.request(self.url+self.pluginPath+pluginFound+"/readme.txt", data=None) 242 | pluginVer = re.findall('Stable tag: (\d+\.\d+[\.\d+]*)', requester.htmltext) 243 | # Add plugin version 244 | if pluginVer : 245 | self.pluginsFoundVers[pluginFound] = pluginVer[0] 246 | else: 247 | # Match has not been found 248 | self.pluginsFoundVers[pluginFound] = None 249 | self.pluginsFound = self.pluginsFoundVers 250 | 251 | # Find WordPress TimThumbs via a dictionary attack 252 | def WPTimThumbs(self): 253 | msg = "Searching Wordpress TimThumbs ..." 254 | report.message(msg) 255 | # Create Code 256 | q = queue.Queue() 257 | # Spawn all threads into code 258 | for u in range(initializer.threads): 259 | t = ThreadScanner(self.url, "/", "", self.timthumbsFound, self.notExistingCode, self.notValidLen, q) 260 | t.daemon = True 261 | t.start() 262 | # Add all plugins to the queue 263 | for r, i in enumerate(self.timthumbs): 264 | q.put(i) 265 | q.join() 266 | sys.stdout.write("\r") 267 | if self.timthumbsFound: 268 | for timthumbsFound in self.timthumbsFound: 269 | msg = self.url + "/" + timthumbsFound 270 | report.medium(msg) 271 | msg = " Timthumbs Potentially Vulnerable to File Upload: http://www.exploit-db.com/wordpress-timthumb-exploitation" 272 | report.medium(msg) 273 | 274 | # Find other WordPress installed via a dictionary attack 275 | def WPThemes(self): 276 | msg = "Searching Wordpress Themes ..." 277 | report.message(msg) 278 | if not initializer.FullScan: self.themes = self.themes_small 279 | # Create Code 280 | q = queue.Queue() 281 | # Spawn all threads into code 282 | for u in range(initializer.threads): 283 | t = ThreadScanner(self.url, self.themePath, "/", self.themesFound, self.notExistingCode, self.notValidLen, q) 284 | t.daemon = True 285 | t.start() 286 | # Add all theme to the queue 287 | for r, i in enumerate(self.themes): 288 | q.put(i) 289 | sys.stdout.write("\r" + str(100 * int(r + 1) / len(self.themes)) + "%") 290 | sys.stdout.flush() 291 | q.join() 292 | sys.stdout.write("\r") 293 | for themesFound in self.themesFound: 294 | msg = themesFound 295 | report.info(msg) 296 | 297 | # Check if XML-RPC services are enabled 298 | def WPXMLRPC_check(self): 299 | msg = "Checking if XML-RPC services are enabled ..." 300 | report.verbose(msg) 301 | self.postdata = '''wp.getUsersBlogs 302 | ThisIsATest 303 | ThisIsATest 304 | ''' 305 | requester.request(self.url + '/xmlrpc.php', data = self.postdata) 306 | if re.search('XML-RPC services are disabled', requester.htmltext): 307 | msg = "XML-RPC services are disabled" 308 | report.verbose(msg) 309 | self.XMLRPCEnable = False 310 | else: 311 | msg = "XML-RPC services are enabled" 312 | report.medium(msg) 313 | 314 | # Check if the XML-RPC Pingback is enabled 315 | def WPXMLRPC_pingback(self): 316 | msg = "Checking XML-RPC Pingback Vulnerability ..." 317 | report.verbose(msg) 318 | self.postdata = '''pingback.ping 319 | http://N0tB3th3re0484940:22/ 320 | ''' + self.url + ''' 321 | ''' 322 | requester.request(self.url + '/xmlrpc.php', data = self.postdata) 323 | if re.search('16', requester.htmltext): 324 | msg = "Website vulnerable to XML-RPC Pingback Force Vulnerability" 325 | report.low(msg) 326 | 327 | # Check if it is possible to brute-froce the logins via XML-RPC 328 | def WPXMLRPC_BF(self): 329 | msg = "Checking XML-RPC Brute Force Vulnerability ..." 330 | report.verbose(msg) 331 | self.postdata = '''wp.getUsersBlogs 332 | admin 333 | 334 | ''' 335 | requester.request(self.url + '/xmlrpc.php', data = self.postdata) 336 | if re.search('403', requester.htmltext): 337 | msg = "Website vulnerable to XML-RPC Brute Force Vulnerability" 338 | report.medium(msg) 339 | if self.currentVer: 340 | if self.currentVer[0] < '4.4': 341 | msg = "Website vulnerable to XML-RPC Amplification Brute Force Vulnerability" 342 | report.medium(msg) 343 | 344 | wpscan = WPScan() 345 | -------------------------------------------------------------------------------- /cmsmap/main.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | import os, sys, time, datetime, signal, socket, argparse, urllib 3 | 4 | from urllib.parse import urlparse 5 | from argparse import RawTextHelpFormatter 6 | from .version import __version__ 7 | from .lib.initialize import initializer 8 | from .lib.bruteforcer import bruter 9 | from .lib.scanner import scanner 10 | from .lib.exploitdbsearch import searcher 11 | from .lib.genericchecks import genericchecker 12 | from .lib.report import report 13 | from .lib.coreupdate import updater 14 | from .lib.postexploit import postexploiter 15 | 16 | 17 | def main(): 18 | # command line arguments 19 | 20 | if sys.argv[1:]: 21 | examples = """Examples: 22 | cmsmap.py https://example.com 23 | cmsmap.py https://example.com -f W -F --noedb -d 24 | cmsmap.py https://example.com -i targets.txt -o output.txt 25 | cmsmap.py https://example.com -u admin -p passwords.txt 26 | cmsmap.py -k hashes.txt -w passwords.txt 27 | """ 28 | try: 29 | parser = argparse.ArgumentParser( 30 | description="CMSmap tool v" + str(__version__) + 31 | " - Simple CMS Scanner\nAuthor: Mike Manzotti", 32 | formatter_class=RawTextHelpFormatter, 33 | add_help=False, 34 | epilog=examples) 35 | # Groups 36 | argsscan = parser.add_argument_group("Scan") 37 | argsbrute = parser.add_argument_group("Brute-Force") 38 | argspostexp = parser.add_argument_group("Post Exploitation") 39 | argsothers = parser.add_argument_group("Others") 40 | # Scan Arguments 41 | argsscan.add_argument("target",help="target URL (e.g. 'https://example.com:8080/')", nargs='?') 42 | argsscan.add_argument("-f", "--force",help="force scan (W)ordpress, (J)oomla or (D)rupal or (M)oodle", 43 | metavar="W/J/D/M",default=None) 44 | argsscan.add_argument("-F", "--fullscan",help="full scan using large plugin lists. False positives and slow!", 45 | action="store_true", default=False) 46 | argsscan.add_argument("-t", "--threads",help="number of threads (Default 5)",metavar="",default=5) 47 | argsscan.add_argument("-a", "--agent",help="set custom user-agent", metavar="") 48 | argsscan.add_argument("-H", "--header",help="add custom header (e.g. 'Authorization: Basic ABCD...')",metavar="") 49 | argsscan.add_argument("-i", "--input",help="scan multiple targets listed in a given file",metavar="") 50 | argsscan.add_argument("-o", "--output",help="save output in a file", metavar="") 51 | argsscan.add_argument("-E", "--noedb",help="enumerate plugins without searching exploits",action="store_true", default=False) 52 | argsscan.add_argument("-c", "--nocleanurls",help="disable clean urls for Drupal only",action="store_true", default=False) 53 | argsscan.add_argument("-s", "--nosslcheck",help="don't validate the server's certificate",action="store_true", default=False) 54 | argsscan.add_argument("-d","--dictattack",help="run low intense dictionary attack during scanning (5 attempts per user)", 55 | action="store_true",default=False) 56 | # Brute-Force Arguments 57 | argsbrute.add_argument("-u", "--usr", help="username or username file", metavar="") 58 | argsbrute.add_argument("-p", "--psw", help="password or password file", metavar="") 59 | argsbrute.add_argument("-x", "--noxmlrpc", help="brute forcing WordPress without XML-RPC", action="store_false", default=True) 60 | # Post Exploitation Arguments 61 | argspostexp.add_argument("-k", "--crack", 62 | help="password hashes file (Require hashcat installed. For WordPress and Joomla only)", metavar="") 63 | argspostexp.add_argument("-w", "--wordlist", help="wordlist file", metavar="") 64 | # Others Arguments 65 | argsothers.add_argument("-v", "--verbose", help="verbose mode (Default false)",action="store_true", default=False) 66 | argsothers.add_argument("-h", "--help", help="show this help message and exit",action="help") 67 | argsothers.add_argument("-D", "--default", help="run CMSmap with default options", action="store_true", default=False) 68 | argsothers.add_argument("-U", "--update", help="use (C)MSmap, (P)lugins or (PC) for both", metavar= "") 69 | args = parser.parse_args() 70 | except: 71 | sys.exit(1) 72 | 73 | else: 74 | msg = "No options provided. Run " + os.path.basename( 75 | sys.argv[0]) + " -h for help" 76 | report.error(msg) 77 | sys.exit(1) 78 | 79 | initializer.verbose = args.verbose 80 | initializer.threads = args.threads 81 | initializer.BruteForcingAttack = bruter.usrlist = args.usr 82 | initializer.CrackingPasswords = hashfile = args.crack 83 | initializer.wordlist = args.wordlist 84 | initializer.threads = int(args.threads) 85 | initializer.output = report.fn = args.output 86 | initializer.forceCMSmapUpdate = args.update 87 | initializer.FullScan = args.fullscan 88 | initializer.NoExploitdb = args.noedb 89 | initializer.disableCleanURLs = args.nocleanurls 90 | initializer.nosslcheck = args.nosslcheck 91 | initializer.default = args.default 92 | scanner.file = args.input 93 | scanner.force = args.force 94 | bruter.wpnoxmlrpc = args.noxmlrpc 95 | bruter.dictattack = args.dictattack 96 | bruter.pswlist = args.psw 97 | 98 | if args.header: 99 | initializer.headers.update({ 100 | args.header.split(":")[0]: 101 | args.header.split(":")[1] 102 | }) 103 | 104 | start = time.time() 105 | msg = "Date & Time: " + time.strftime('%d/%m/%Y %H:%M:%S') 106 | report.status(msg) 107 | 108 | updater.UpdateExploitDB() 109 | updater.CheckLocalFiles() 110 | 111 | if initializer.forceCMSmapUpdate: 112 | updater.forceCMSmapUpdate() 113 | elif initializer.BruteForcingAttack: 114 | if scanner.file is not None: 115 | targets = [line.strip() for line in open(scanner.file)] 116 | else: 117 | targets = [args.target] 118 | for url in targets: 119 | if url.endswith("/"): 120 | url = url[:-1] 121 | try: 122 | initializer.url = genericchecker.url = scanner.url = bruter.url = searcher.url = url 123 | addr = socket.gethostbyname(urlparse(url).hostname) 124 | msg = "Target: " + scanner.url + " (" + addr + ")" 125 | report.status(msg) 126 | if scanner.force is None: 127 | scanner.FindCMSType() 128 | else: 129 | bruter.force = scanner.force 130 | bruter.Start() 131 | except urllib.request.URLError as e: 132 | msg = "Unable to scan: " + scanner.url 133 | report.error(msg) 134 | report.error(str(e.reason)) 135 | except socket.gaierror as e : 136 | msg = "Unable to resolve: " + scanner.url 137 | report.error(msg) 138 | msg = str(e) 139 | report.error(msg) 140 | elif initializer.CrackingPasswords: 141 | postexploiter.CrackingHashesType(hashfile, initializer.wordlist) 142 | elif scanner.file is not None: 143 | targets = [line.strip() for line in open(scanner.file)] 144 | for url in targets: 145 | if url.endswith("/"): 146 | url = url[:-1] 147 | try: 148 | initializer.url = genericchecker.url = scanner.url = bruter.url = searcher.url = url 149 | addr = socket.gethostbyname(urlparse(url).hostname) 150 | msg = "Threads: " + str(initializer.threads) 151 | report.info(msg) 152 | msg = "Target: " + scanner.url + " (" + addr + ")" 153 | report.status(msg) 154 | scanner.RunScanner() 155 | except urllib.request.URLError as e: 156 | msg = "Unable to scan: " + scanner.url 157 | report.error(msg) 158 | report.error(str(e.reason)) 159 | except socket.gaierror as e : 160 | msg = "Unable to resolve: " + scanner.url 161 | report.error(msg) 162 | msg = str(e) 163 | report.error(msg) 164 | else: 165 | if args.target.endswith("/"): 166 | args.target = args.target[:-1] 167 | try: 168 | addr = socket.gethostbyname(urlparse(args.target).hostname) 169 | initializer.url = genericchecker.url = scanner.url = bruter.url = searcher.url = args.target 170 | msg = "Threads: " + str(initializer.threads) 171 | report.info(msg) 172 | msg = "Target: " + scanner.url + " (" + addr + ")" 173 | report.status(msg) 174 | scanner.RunScanner() 175 | except urllib.request.URLError as e: 176 | msg = "Unable to scan: " + scanner.url 177 | report.error(msg) 178 | report.error(str(e.reason)) 179 | except socket.gaierror as e : 180 | msg = "Unable to resolve: " + scanner.url 181 | report.error(msg) 182 | msg = str(e) 183 | report.error(msg) 184 | 185 | end = time.time() 186 | diffTime = end - start 187 | msg = "Date & Time: " + time.strftime('%d/%m/%Y %H:%M:%S') 188 | report.status(msg) 189 | msg = "Completed in: " + str( 190 | datetime.timedelta(seconds=diffTime)).split(".")[0] 191 | report.status(msg) 192 | if initializer.output: 193 | msg = "Output File Saved in: " + report.fn 194 | report.status(msg) 195 | -------------------------------------------------------------------------------- /cmsmap/shell/dru-shell.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/shell/dru-shell.zip -------------------------------------------------------------------------------- /cmsmap/shell/joo-shell.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/shell/joo-shell.zip -------------------------------------------------------------------------------- /cmsmap/shell/wp-shell.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/dionach/CMSmap/59dd0e2b3b0c751c6da2b0565374ab83c736b0e6/cmsmap/shell/wp-shell.zip -------------------------------------------------------------------------------- /cmsmap/version.py: -------------------------------------------------------------------------------- 1 | __version__ = '1.0' 2 | -------------------------------------------------------------------------------- /setup.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | 3 | from setuptools import setup, find_packages 4 | 5 | version = {} 6 | with open('cmsmap/version.py') as f: 7 | exec(f.read(), version) 8 | 9 | setup( 10 | name='cmsmap', 11 | version=version['__version__'], 12 | description='CMS vulnerability scanner', 13 | author='Mike Manzotti', 14 | # author_email='', 15 | url='https://github.com/Dionach/CMSmap', 16 | license='GPL', 17 | packages=find_packages(), 18 | package_data={'': ['*.conf', '*.txt', '*.zip']}, 19 | entry_points={'console_scripts': [ 20 | 'cmsmap = cmsmap.main:main', 21 | ]}, 22 | install_requires=[ 23 | #'package>=version' 24 | ]) 25 | --------------------------------------------------------------------------------