CMSmap
Tool and Usage
Project details
- Inception
- License
- GPLv3
- Programming language
- Python
- Author
- Mike Manzotti
- Latest release
- No release found
Project health
Why this tool?
CMSmap helps saving time in the process of detecting what CMS is used for a given web application. It performs reconnaissance and can do additional vulnerability scanning.
How it works
CMSmap scans a web application by looking at HTTP headers and returned HTML code. Upon detection of the used CMS, the tool will start more specific tests for that CMS. It may go for the detection of particular themes, user names, or plugins.
Background information
Supported CMS:
- WordPress
- Joomla
- Drupal
Usage and audience
CMSmap is commonly used for application testing, information gathering, vulnerability scanning, or web application analysis. Target users for this tool are pentesters, security professionals, and system administrators.
Example usage and output
Author: Mike Manzotti mike.manzotti@dionach.com
Usage: cmsmap.py -t <URL>
Targets:
-t, --target target URL (e.g. 'https://example.com:8080/')
-f, --force force scan (W)ordpress, (J)oomla or (D)rupal
-F, --fullscan full scan using large plugin lists. False positives and slow!
-a, --agent set custom user-agent
-T, --threads number of threads (Default: 5)
-i, --input scan multiple targets listed in a given text file
-o, --output save output in a file
--noedb enumerate plugins without searching exploits
Brute-Force:
-u, --usr username or file
-p, --psw password or file
--noxmlrpc brute forcing WordPress without XML-RPC
Post Exploitation:
-k, --crack password hashes file (Require hashcat installed. For WordPress and Joomla only)
-w, --wordlist wordlist file
Others:
-v, --verbose verbose mode (Default: false)
-U, --update (C)MSmap, (W)ordpress plugins and themes, (J)oomla components, (D)rupal modules, (A)ll
-h, --help show this help
Examples:
cmsmap.py -t https://example.com
cmsmap.py -t https://example.com -f W -F --noedb
cmsmap.py -t https://example.com -i targets.txt -o output.txt
cmsmap.py -t https://example.com -u admin -p passwords.txt
cmsmap.py -k hashes.txt -w passwords.txt
Tool review and remarks
The review and analysis of this project resulted in the following remarks for this security tool:
Strengths
- + More than 500 contributors
- + The source code of this software is available
Weaknesses
- - No releases on GitHub available
- - No updates for a while
Installation
Supported operating systems
CMSmap is known to work on Linux.
Installation options
To use CMSmap, install it via the following method below.
git-clone-cmsmap
git clone https://github.com/Dionach/CMSmap
After installation, check the version number of the program and compare it with the one on this page. Be aware of versions that are outdated, as they may contain bugs or even security vulnerabilities.
CMSmap alternatives
Similar tools to CMSmap:
CMSeeK
CMSeeK is a security scanner for content management systems (CMS) and used for security assessments. Read how it works in this review.
Th3inspector
Th3inspector is an information gathering tool to collect information about domains, DNS, web applications, and more. It may be used for security assessments.
This tool page was updated at . Found an improvement? Help the community by submitting an update.
Related tool information
Categories
This tool is categorized as a application detection tool, CMS scanner, vulnerability scanner, web application reconnaissance tool, and website reconnaissance tool.