CMS Scanner

Burp Suite is a leading web application security testing toolkit designed for identifying and analyzing security vulnerabilities in web applications. Developed by PortSwigger, Burp Suite offers a comprehensive set of tools that facilitate manual and automated testing processes. It includes features for mapping application structure, discovering potential security issues, and testing for common web vulnerabilities such as SQL injection and cross-site scripting. With its intuitive interface and extensible architecture, Burp Suite is widely used by security professionals, penetration testers, and developers to assess and strengthen the security of web applications throughout the development lifecycle.

Burp Suite, a powerful web application security testing tool, provides a variety of features to assist security professionals in identifying vulnerabilities within Content Management Systems (CMS). One notable capability is the extensibility of Burp Suite, allowing users to enhance its functionality through custom plugins and extensions. Several community-developed CMS scanner extensions are available for Burp Suite, enabling security testers to automate the detection of common CMS-related vulnerabilities.

These CMS scanner extensions typically leverage various techniques to identify the CMS in use, such as analyzing unique patterns in HTML responses, examining HTTP headers, or detecting specific CMS-related files and directories. Once the CMS is identified, these extensions often perform additional checks for known vulnerabilities associated with the detected CMS, aiding in the discovery of issues like SQL injection, cross-site scripting (XSS), and other security weaknesses. By integrating CMS scanning into the broader web application security assessment workflow, security professionals can efficiently pinpoint and address CMS-specific vulnerabilities, contributing to a comprehensive assessment of a web application's security posture.

HOW TO INSTALL AND USE CMS SCANNER

Download Burp Suite: Visit the official Burp Suite download page at http://portswigger.net/burp/download.html and download the version suitable for your system (Windows, macOS, or Linux).

Launch Burp Suite: Begin by opening Burp Suite, a versatile web vulnerability scanner and security assessment tool. You'll need Burp Suite Professional to access advanced features.

Access the Extender Tab: Navigate to the "Extender" tab within Burp Suite. This is where you can manage extensions and add new ones to enhance Burp Suite's functionality.

Install the " CMS Scanner " Extension: Inside the "Extender" tab, visit the "BApp Store. Search for the "CMS Scanner" extension and install it.

Select Your Target Website: Head to the "Proxy" tab within Burp Suite. In this section, you can see the traffic of a specific website that you want to scan for security vulnerabilities. Right-click on the target website and select "Do an Active Scan." This command initiates the scanning process.

Monitor Scanning Progress: To keep track of the scanning process and its outcomes, navigate to the "Scanner" tab in Burp Suite. Here, you'll find the "Issue Activity" section, which provides a detailed log of the scan's progression, discovered issues, and actions executed by Burp Suite during the scan.

TEST CASES ARE AS FOLLOWS:

An active scan extension for Burp that provides supplemental coverage when testing popular content management systems.

Test cases:

• Drupal - CVE-2014-3704 - SQL Injection (Drupalgeddon)
• Joomla - CVE-2017-8917 - SQL Injection
• Wordpress - CVE-2017-9603 - WP Jobs Plugin - SQL Injection

Wordpress - Single Personal Message Plugin - SQL Injection