security enabled verified medium v1.0.0

cmsmap

Content Management System security scanner supporting WordPress, Joomla, Drupal, and Moodle fingerprinting and enumeration.

📋 Live Preview

cmsmap -t {target}

🌍 target → url

cmsmap -t {target}

Sandbox: execFile · Timeout: 600s

Capabilities

web.discovery.asset

web.fingerprint.cms

web.enumeration.component

web.vulnerability.scanner

web.enumeration.user

Parameters

Name	Type	Required	Default	Description	Aliases
`target`	string	Yes	-	Target URL or hostname	`-t`, `--target`
`url`	string	No	-	Full URL to scan (alternative to -t)	`-u`, `--url`
`force`	boolean	No	-	Force scan even if CMS detection fails	`-f`, `--force`
`force-ssl`	boolean	No	-	Force HTTPS connection	`-F`, `--force-ssl`
`user-agent`	string	No	-	Custom User-Agent header	`-a`, `--user-agent`
`headers`	string	No	-	Additional HTTP headers (comma-separated)	`-H`, `--headers`
`proxy`	string	No	-	HTTP proxy address	`-p`, `--proxy`
`verbose`	boolean	No	-	Verbose output	`-v`, `--verbose`
`output`	string	No	-	Output file for results	`-o`, `--output`
`input-file`	file	No	-	File containing list of target URLs	`-i`, `--input-file`
`detect`	boolean	No	-	Detect CMS type only (no deep scan)	`-d`, `--detect`
`enumerate`	boolean	No	-	Enable enumeration of users and components	`-E`, `--enumerate`
`extensions`	string	No	-	File extensions to check (comma-separated)	`-x`, `--extensions`
`wordlist`	file	No	-	Custom wordlist for brute force	`-w`, `--wordlist`
`recursive`	boolean	No	-	Recursive directory enumeration	`-r`, `--recursive`
`s`	boolean	No	-	Force SSL/HTTPS connection	`-s`, `--ssl`

Artifacts

Type	Description	MIME	Schema	Trust
`report.json`	Scan results as JSON	application/json	-	verified
`report.csv`	Scan results as CSV	text/csv	-	verified

Contract

Inputs

web.target.url

Target CMS URL to scan

web.target.domain

Target domain for CMS detection

network.target.file

File containing list of target URLs

Outputs

report.json

CMS scan report as JSON

report.csv

CMS scan report as CSV

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

report.jsonreport.csv

Consumes

web.target.urlweb.target.domainnetwork.target.file

Resource Profile

Resource	Value
CPU	low
Memory	128 MB
Network	medium
Disk I/O	low

Examples

Basic CMS scan

cmsmap -t http://target.com

Force WordPress scan over HTTPS

cmsmap -t http://target.com -F -f

CMS scan with proxy and verbose output

cmsmap -t http://target.com -p http://127.0.0.1:8080 -v

Enumerate users and components

cmsmap -t http://target.com -E

Scan multiple targets from file

cmsmap -i targets.txt -o results.csv

CMS detection only

cmsmap -t http://target.com -d

Documentation

CMSMap — CMS Security Scanner

CMSMap is a security scanner for popular Content Management Systems (WordPress, Joomla, Drupal, and Moodle) that performs fingerprinting, version detection, user enumeration, and vulnerability scanning.

Basic Usage

# Basic scan of a CMS website
cmsmap -t http://target.com

# Enumerate users and components
cmsmap -t http://target.com -E

# Scan through a proxy
cmsmap -t http://target.com -p http://127.0.0.1:8080 -v

# Scan multiple targets from a file
cmsmap -i targets.txt -o results.csv

Supported CMS

CMS	Detection	Enumeration
WordPress	Core version, plugins, themes	Users, vulnerable plugins
Joomla	Core version, components	Users, vulnerable extensions
Drupal	Core version, modules	Users, vulnerable modules
Moodle	Core version, plugins	Users, courses

Related Tools

wpscanjoomscanwhatweb