# Web Cms Scanning

> CMS-specific scans — WordPress (wpscan), Joomla, Drupal version detection.

- Skill: `purpleailab/web-cms-scanning` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/web-cms-scanning`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/web-cms-scanning/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/web-cms-scanning

---


# CMS-Specific Scanning

Once tech fingerprinting (or HTML inspection) confirms a CMS, switch from generic discovery to CMS-aware tooling — version, plugins/themes, user enum, and CMS-specific RCE entry points.

## WordPress

```bash
# wpscan (comprehensive)
wpscan --url https://<target> --enumerate vp,vt,u,be --api-token <WP_API_TOKEN>

# Quick checks
curl -s "https://<target>/wp-json/wp/v2/users" | python3 -m json.tool
curl -s "https://<target>/xmlrpc.php" -d '<methodCall><methodName>system.listMethods</methodName></methodCall>'
curl -s "https://<target>/?author=1" -I | grep Location
```

## Joomla

```bash
# Version detection
curl -s "https://<target>/administrator/manifests/files/joomla.xml" | grep -oP '<version>\K[^<]+'
```

## Drupal

```bash
curl -s "https://<target>/CHANGELOG.txt" | head -5
```