Skip to content
HackIndex logo

HackIndex

Joomla Enumeration

4 min read Mar 30, 2026

Joomla enumeration identifies the installed version, active components, plugins, templates, and user accounts. Version is the critical signal — Joomla has a history of high-severity unauthenticated RCE and SQL injection vulnerabilities tied to specific releases and components. Run this after tech fingerprinting confirms Joomla.

Confirm Joomla and Version

The XML manifest and admin generator tag disclose the version before running any tooling:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/administrator/manifests/files/joomla.xml | grep -i version 
<version>3.9.26</version>
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
http://$TARGET_IP:$PORT/administrator/manifests/files/joomla.xml Target URL with variable host and port pointing to Joomla manifest file.
-i Makes the grep pattern match case-insensitive.
version Search pattern to filter lines containing version information.
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/ | grep -i 'joomla\|generator' 
<meta name="generator" content="Joomla! - Open Source Content Management" />
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure SSL connections, skipping certificate verification.
http://$TARGET_IP:$PORT/ Target URL using variable placeholders for IP and port.
-i Makes the grep pattern match case-insensitive.
'joomla\|generator' Grep pattern matching lines containing 'joomla' or 'generator'.
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/language/en-GB/en-GB.xml | grep -i version 
<version>3.9.26</version>
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL/TLS connections, skipping certificate verification.
http://$TARGET_IP:$PORT/language/en-GB/en-GB.xml Target URL with variable host and port pointing to a language XML file.
-i Makes the grep pattern match case-insensitive.
version Search pattern to filter lines containing 'version' from the XML output.

joomscan

joomscan is the primary automated tool for Joomla enumeration. It identifies version, vulnerable components, configuration issues, and backup files:

┌──(kali㉿kali)-[~]
└─$ joomscan -u http://$TARGET_IP:$PORT/ 
[+] Detecting Joomla Version
[++] Joomla 3.9.26

[+] Core Joomla Vulnerability
[++] Target Joomla core is not vulnerable

[+] Checking Directory Listing
[++] directory has directory listing : http://10.10.10.50/administrator/components
Explain command
-u Specifies the target URL to scan.
http://$TARGET_IP:$PORT/ Target Joomla base URL with dynamic IP and port placeholders.
┌──(kali㉿kali)-[~]
└─$ joomscan -u http://$TARGET_IP:$PORT/ --enumerate-components
Explain command
-u Specifies the target URL to scan.
http://$TARGET_IP:$PORT/ Target host IP and port placeholder forming the base URL.
--enumerate-components Enumerates installed Joomla components on the target.

Admin Panel and Configuration Checks

Check whether the admin panel is accessible and whether configuration files are exposed:

┌──(kali㉿kali)-[~]
└─$ curl -sk -o /dev/null -w '%{http_code}' http://$TARGET_IP:$PORT/administrator/ 
200
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
-o /dev/null Discard response body by redirecting output to /dev/null.
-w '%{http_code}' Print only the HTTP response status code after the request.
http://$TARGET_IP:$PORT/administrator/ Target URL built from variable host, port, and path to probe.
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/configuration.php.bak
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/configuration.php~
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/configuration.php.old
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections; skip certificate verification.
http://$TARGET_IP:$PORT/configuration.php.bak Target URL with IP, port, and backup file path placeholder.
http://$TARGET_IP:$PORT/configuration.php~ Target URL pointing to a tilde-suffixed editor backup file.
http://$TARGET_IP:$PORT/configuration.php.old Target URL pointing to a .old suffixed leftover config file.

User Enumeration

Joomla exposes user data through the API and registration error messages:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/api/index.php/v1/users | python3 -m json.tool
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
http://$TARGET_IP:$PORT/api/index.php/v1/users Target URL with variable host and port pointing to Joomla users API endpoint.
-m json.tool Runs Python's built-in json.tool module to pretty-print JSON output.
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:$PORT/index.php -d 'option=com_users&task=user.login&username=admin&password=wrongpassword' | grep -i 'invalid\|error\|username'
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
-X POST Specifies HTTP POST as the request method.
http://$TARGET_IP:$PORT/index.php Target URL with variable host IP and port placeholders.
-d 'option=com_users&task=user.login&username=admin&password=wrongpassword' Sends URL-encoded POST body with Joomla login credentials.
-i 'invalid\|error\|username' Case-insensitive grep filter for keywords: invalid, error, or username.

Component and Plugin Enumeration

Joomla components often have their own vulnerabilities separate from core. Enumerate installed components by probing common paths:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/CMS/joomla-components.txt -u http://$TARGET_IP:$PORT/index.php?option=FUZZ -mc 200,301,302 -fw 100
Explain command
-w /usr/share/seclists/Discovery/Web-Content/CMS/joomla-components.txt Wordlist file path used for fuzzing input.
-u http://$TARGET_IP:$PORT/index.php?option=FUZZ Target URL with FUZZ keyword marking the injection point.
$TARGET_IP:$PORT Variable placeholders for the target host IP and port.
-mc 200,301,302 Match only responses with HTTP status codes 200, 301, or 302.
-fw 100 Filter out responses containing exactly 100 words in the body.
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:$PORT/administrator/components/ | grep -i 'href' | grep -oP '(?<=href=")[^"]+' | sort -u
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Skips SSL/TLS certificate verification.
http://$TARGET_IP:$PORT/administrator/components/ Target URL with variable host and port placeholders.
-i Case-insensitive pattern matching in grep.
-o Prints only the matched part of the line.
-P Enables Perl-compatible regular expressions (PCRE).
(?<=href=")[^"]+' PCRE lookbehind to extract URL values from href attributes.
-u Outputs only unique sorted lines, removing duplicates.

Cross-reference identified components and their versions against the Joomla Vulnerable Extension List. Third-party components are far more frequently vulnerable than Joomla core and are the most common path to exploitation.

References