Joomscan – OWASP Joomla Vulnerability Scanner Project

JoomScan or OWASP Joomla Vulnerability Scanner is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. Implemented in Perl, this tool enables seamless and effortless scanning of Joomla installations, while leaving a minimal footprint with its lightweight and modular architecture. It not only detects known offensive vulnerabilities, but also is able to detect many misconfigurations and admin-level shortcomings that can be exploited by adversaries to compromise the system. Furthermore, OWASP Joomla Vulnerability Scanner provides a user-friendly interface and compiles the final reports in both text and HTML formats for ease of use and minimization of reporting overheads.

OWASP Joomla Vulnerability Scanner is included in Kali Linux distributions.

Also Read WarChild – Denial Of Service Testing Suite Made For Analyzing


  • Version enumerator
  • Vulnerability enumerator (based on version)
  • Components enumerator (1209 most popular by default)
  • Components vulnerability enumerator (based on version)(+1030 exploit)
  • Firewall detector
  • Reporting to Text & HTML output
  • Finding common log files
  • Finding common backup files


git clone
cd joomscan


Usage: [options]

--url | -u <URL>                |   The Joomla URL/domain to scan.
--enumerate-components | -ec    |   Try to enumerate components.

--cookie <String>               |   Set cookie.
--user-agent | -a <user-agent>  |   Use the specified User-Agent.
--random-agent | -r             |   Use a random User-Agent.
--timeout <time-out>            |   set timeout.
--about                         |   About Author
--update                        |   Update to the latest version.
--help | -h                     |   This help screen.
--version                       |   Output the current version and exit.

OWASP Joomla Vulnerability Scanner Usage Examples

Do default checks...
perl --url
perl -u
Enumerate installed components…
perl --url --enumerate-components
perl -u --ec
Set cookie
perl --url --cookie "test=demo;"
Set user-agent
perl --url --user-agent "Googlebot/2.1 (+"
perl -u -a "Googlebot/2.1 (+"
Set random user-agent
perl -u --random-agent
perl --url -r
Update Joomscan…
perl --update

OWASP Joomla Vulnerability Scanner Introduction