> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-discovery/cms-scanning.md).

# CMS Scanning

## CMSmap

CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool.

At the moment, CMSs supported by CMSmap are WordPress, Joomla, Drupal and Moodle.

## Droopescan 

Scan a Drupcal installation.

## WPScan

WPScan is a black box WordPress vulnerability scanner. It's a command-line tool designed for assessing the security posture of WordPress websites.

WPScan Cheat Sheets:

* <https://pentesting.site/cheat-sheets/wpscan-cheat-sheet/>

## Resources

CMSmap - GitHub: <https://github.com/dionach/CMSmap>

Content management system - Wikipedia: <https://en.wikipedia.org/wiki/Content_management_system>

WPScan - Documentation: <https://github.com/wpscanteam/wpscan/wiki/WPScan-User-Documentation>

WPScan - GitHub: <https://github.com/wpscanteam/wpscan>

WPScan - Homepage: <https://wpscan.com/>