# Drupal enumeration

> Techniques for enumerating Drupal CMS installations, including version detection, module discovery, user enumeration, and identifying misconfigurations via droopescan and manual methods.

- **URL:** https://hackindex.io/services/web/enumeration/drupal-enumeration
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-01-23
- **Updated:** 2026-04-24

Drupal enumeration identifies the installed version, active modules, themes, and user accounts. The version is the critical signal: Drupal 7 and older Drupal 8 releases have well-known RCE vulnerabilities including Drupalgeddon2 and Drupalgeddon3. Run this after [tech fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting) confirms Drupal.

Key Drupal paths to probe early:

- `/CHANGELOG.txt`: version disclosure (Drupal 7)
- `/core/CHANGELOG.txt`: version disclosure (Drupal 8/9/10)
- `/install.txt`, `/core/INSTALL.txt`: confirms Drupal presence
- `/sites/all/modules/`: contributed module directory (Drupal 7)
- `/modules/`: module directory (Drupal 8+)
- `/?q=user/login`: login form, useful for user enumeration
- `/?q=admin`: admin panel accessibility
- `/?q=user/register`: open registration check

## Confirm Drupal and Version

Version is often disclosed in the changelog or install.txt files before any tooling is needed:

```bash
curl -sk http://$TARGET_IP:$PORT/CHANGELOG.txt | head -5
# Drupal 7.57, 2018-02-21
```

```bash
curl -sk http://$TARGET_IP:$PORT/core/CHANGELOG.txt | head -5
```

```bash
curl -sk http://$TARGET_IP:$PORT/install.txt | head -5
```

Drupal 7 uses `/CHANGELOG.txt`. Drupal 8 and 9 use `/core/CHANGELOG.txt`. If the files are removed, check the meta generator tag:

```bash
curl -sk http://$TARGET_IP:$PORT/ | grep -i 'generator\|drupal'
# <meta name="generator" content="Drupal 7 (https://www.drupal.org)" />
```

## droopescan

droopescan enumerates modules, themes, and version ranges passively. It's slower than manual checks but more thorough on module discovery:

```bash
droopescan scan drupal -u http://$TARGET_IP:$PORT/
# [+] Plugins found:
#     views http://10.10.10.50/sites/all/modules/views/
#     token http://10.10.10.50/sites/all/modules/token/
#
# [+] Themes found:
#     bartik http://10.10.10.50/themes/bartik/
#
# [+] Possible version(s):
#     7.57
```

## User Enumeration

Drupal 7 leaks usernames through login error messages and the node/user system. Confirm with a direct probe:

```bash
curl -sk http://$TARGET_IP:$PORT/?q=user/1
```

```bash
curl -sk -d 'name=admin&pass=wrongpassword&form_id=user_login&op=Log+in' http://$TARGET_IP:$PORT/?q=user/login | grep -i 'error\|unrecognized'
# Sorry, unrecognized username or password.
```

If the error says "unrecognized username" for a non-existent user but "incorrect password" for a valid one, the application is vulnerable to username enumeration.

## Admin Panel and Registration Check

Check whether registration is open and the admin panel is reachable:

```bash
curl -sk -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/?q=admin
# 200
```

```bash
curl -sk -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/?q=user/register
```

## Module and Theme Path Probing

Probe known module paths to identify which are installed without droopescan:

```bash
ffuf -w /usr/share/seclists/Discovery/Web-Content/CMS/drupal-modules.txt -u http://$TARGET_IP:$PORT/sites/all/modules/FUZZ/ -mc 200,301,302,403
```

A Drupal 7 install on a vulnerable version is a high-priority finding. Drupalgeddon2 (CVE-2018-7600) affects Drupal 6, 7, and 8 before specific patch versions and gives unauthenticated RCE. Cross-reference the version against known CVEs before moving to exploitation.

## References

- [droopescan](https://github.com/droope/droopescan) - Plugin-based CMS scanner supporting Drupal, WordPress, Joomla, Silverstripe
- [Drupal Security Advisories](https://www.drupal.org/security) - Official Drupal CVE and patch reference