LSE toolsLSE toolsCMSmap (305)CMSmap (305)

Tool and Usage

Project details

Programming language
Mike Manzotti
Latest release
No release found

Project health

This score is calculated by different factors, like project age, last release date, etc.

Why this tool?

CMSmap helps saving time in the process of detecting what CMS is used for a given web application. It performs reconnaissance and can do additional vulnerability scanning.

How it works

CMSmap scans a web application by looking at HTTP headers and returned HTML code. Upon detection of the used CMS, the tool will start more specific tests for that CMS. It may go for the detection of particular themes, user names, or plugins.

Background information

Supported CMS:

  • WordPress
  • Joomla
  • Drupal

The development of this tool looks to be stalled or stopped.

Usage and audience

CMSmap is commonly used for application testing, information gathering, vulnerability scanning, or web application analysis. Target users for this tool are pentesters, security professionals, and system administrators.

Example usage and output

CMSmap tool v0.6 - Simple CMS Scanner
Author: Mike Manzotti
Usage: -t <URL>
-t, --target target URL (e.g. '')
-f, --force force scan (W)ordpress, (J)oomla or (D)rupal
-F, --fullscan full scan using large plugin lists. False positives and slow!
-a, --agent set custom user-agent
-T, --threads number of threads (Default: 5)
-i, --input scan multiple targets listed in a given text file
-o, --output save output in a file
--noedb enumerate plugins without searching exploits

-u, --usr username or file
-p, --psw password or file
--noxmlrpc brute forcing WordPress without XML-RPC

Post Exploitation:
-k, --crack password hashes file (Require hashcat installed. For WordPress and Joomla only)
-w, --wordlist wordlist file

-v, --verbose verbose mode (Default: false)
-U, --update (C)MSmap, (W)ordpress plugins and themes, (J)oomla components, (D)rupal modules, (A)ll
-h, --help show this help

Examples: -t -t -f W -F --noedb -t -i targets.txt -o output.txt -t -u admin -p passwords.txt -k hashes.txt -w passwords.txt

Tool review and remarks

The review and analysis of this project resulted in the following remarks for this security tool:


  • + More than 500 contributors
  • + The source code of this software is available


  • - No releases on GitHub available
  • - No updates for a while

Author and Maintainers

CMSmap is under development by Mike Manzotti.


Supported operating systems

CMSmap is known to work on Linux.

Installation options

To use CMSmap, install it via the following method below.


git clone

After installation, check the version number of the program and compare it with the one on this page. Be aware of versions that are outdated, as they may contain bugs or even security vulnerabilities.

CMSmap alternatives

Similar tools to CMSmap:



CMSeeK is a security scanner for content management systems (CMS) and used for security assessments. Read how it works in this review.



Vane is a forked project of the now non-free popular WordPress vulnerability scanner WPScan.



Th3inspector is an information gathering tool to collect information about domains, DNS, web applications, and more. It may be used for security assessments.

All CMSmap alternatives

This tool page was updated at . Found an improvement? Help the community by submitting an update.