Security is as important as website design and content, but we often ignore this until negatively impacted. Not correctly configured/hardened Joomla server can be vulnerable to many including remote code execution, SQL Injection, Cross-Site Scripting, Information leakage, etc. Security is a process cycle, which one should always perform against web applications. In this article, I will talk about tools to scan the Joomla website for vulnerability to protect from evil.
Hacker Target
Joomla security scan by Hacker Target has two options. Passive scan – this is a FREE scan, and it does the following.
Google safe browsing look-upDirectory index lookupExternal link and their web reputationList of external iFrames, JavaScriptGeolocation & web hosting lookup
Aggressive, active scan – this requires membership and check aggressively to detect known exploits and vulnerabilities in themes, extensions, modules, components & Joomla core.
SiteGuarding
SiteGuarding is a cloud-based website security scanner which also provides Joomla extension to analyze your website. In the FREE version of the extension, you get the following.
Scan up to 500 filesDaily virus database updateReportingOne scan per dayHeuristic logic
You may also want to try their Antivirus Scanner extension.
Detectify
Detectify is an enterprise-ready SaaS scanner for comprehensive website auditing with more than 1000 vulnerabilities including OWASP top 10. It does security checks on CMS like Joomla, WordPress, Drupal, etc. to ensure CMS specific vulnerabilities are covered. It is not entirely free but you can avail their trial offer to see how it works.
JAMSS
JAMSS (Joomla Anti Malware Scan Script) is a script that you got to install on your website root location. Script installation is nothing but uploading the file jamss.php common to your webroot. JAMSS identifies typical fingerprints, traces that could have been compromised. The script doesn’t harm anything and to access the scan report; you just access yourwebsite.com/jamss.php
SUCURI
Site Check by SUCURI check for known malware, blacklisting, SPAM, defacement and give you information on a web server, links & included scripts.
Security Check
Security Check extension protects your website for more than 90 attacks pattern, and it has an inbuilt vulnerability check to test installed extensions for any security risk.
Joomscan
Joomscan is one of the most popular open-source tools to help you in finding known vulnerabilities of Joomla Core, Components, and SQL Injection, Command execution. There are two ways you can get this running.
Download from OWASP site and install on your PCUse Kali Linux which comes with more than 600 tools including Joomscan
Once you have Joomscan installed, here is how you can run it on the Joomla site to scan the vulnerability. Ex, I executed my test site. As you can see above in the results, it’s scanning for more than 20 vulnerabilities and let you know if any found so you can fix and secure Joomla.
Pentest-Tools
Joomla Vulnerability Scan by Pentest-Tools is powered by the JoomlaVS tool. You can run this test against your site to quickly find out if the core, template, and module is vulnerable. After the test is done, it generates a beautiful report which has all the finding details. It is like performing a penetration test.
Conclusion
I hope the above tools help you to scan Joomla for vulnerabilities and keep your website safe and secure. Here are some of the useful resources to keep you up-to-date with Security.
Joomla Vulnerable Extension list – http://vel.joomla.org/Joomla CVE Details – http://www.cvedetails.com/vulnerability-list/vendor_id-3496/product_id-16499/Joomla-Joomla-.htmlJoomla Developer Network (Security Centre) – http://developer.joomla.org/security-centre.htmlJoomla Security Documentation – https://docs.joomla.org/SecurityTools to Scan Website Security – https://geekflare.com/online-scan-website-security-vulnerabilities/Joomla Security Best Practice – https://geekflare.com/joomla-security/
