Skip to main content
Joomla sits somewhere between WordPress and Drupal in terms of ecosystem size, enough third-party components and templates to make vulnerable extension hunting worthwhile, but version fingerprinting still matters since core RCEs and directory traversal bugs have shown up repeatedly across major versions. The authenticated path to a shell is almost identical to WordPress and Drupal: edit a template file through the admin panel and call it directly.

Unauthenticated

Version fingerprinting via manifest/meta files, user enumeration, and checking installed extensions against known CVEs.

Authenticated

With admin access to Templates, editing a template file for direct PHP execution.

​
Fingerprinting the Version

Joomla’s version shows up in several places depending on what’s been cleaned up post-install, worth checking all of them since any one can be missing.
The homepage’s generator meta tag is the fastest check if nothing’s been hardened:

​
JoomScan

JoomScan (OWASP) is the Joomla-specific equivalent of WPScan, covering version fingerprinting, user enumeration, and known vulnerabilities in one pass.
Enumerate installed extensions and registered users, both useful before deciding where to focus.
Check for known vulnerabilities across detected components, and save the full report.

​
Droopescan

Droopescan also covers Joomla despite its Drupal-leaning name, worth running alongside JoomScan since the two sometimes catch different things.

​
JoomlaScan

An older, standalone scanner, still useful as a second opinion, it needs Python 2 and BeautifulSoup to run.

​
Login Brute Forcing

A dedicated brute-force script against the admin login, swap in the real wordlist path for your environment.

​
Getting a Webshell (Authenticated)

Once you have admin access, the Template Manager works exactly the same way WordPress’s theme editor does, edit a template file and execute PHP through it directly.
1

Open the template editor

In the admin dashboard, go to Templates → Configuration, pick a template name, then open one of its files for editing.
2

Insert the payload

Add a one-line PHP backdoor to the file:
Save it.
3

Trigger it directly

Request the edited file with your command in the query string. The default Protostar template’s error page is a common, rarely-noticed choice:

​
Quick Reference Tools

Hackviser: JoomScan

Reference used for this page.

HackTricks: Joomla

Deeper dive into version fingerprinting paths covered above.

JoomScan

OWASP’s Joomla-specific vulnerability scanner.

Droopescan

Multi-CMS scanner, also covers Joomla.

JoomlaScan

Older standalone scanner, Python 2 only.

joomla-bruteforce

Dedicated login brute-force script.
Brute forcing the admin login and editing templates both leave clear traces (failed-login logs, a modified file in version control if the site uses one). Confirm both are in scope before using them.