Enumerating Joomla plugins and modules using Metasploit

We can also use inbuilt auxiliaries of Metasploit to perform the enumeration of Joomla. The following are the categories for enumerating Joomla that are available in Metasploit:

• Page enumeration
• Plugin enumeration

Page enumeration

The first one is page enumeration. This auxiliary scans for common pages that exist in Joomla, such as readme and robots.txt.

To use the auxiliary, we use the following command:

use auxiliary/scanner/http/joomla_pages

We then see the various module options by using the show options command, as shown:

We set RHOSTS and RPORT and run the module. The pages discovered will be printed once the module is complete, as shown:

The next step is to...