Joomla Security Report HackerTarget.com HackerTarget.com is the world leader in online open source intelligence and security assessments. All scanning tools are on-line for easy and convenient access. All HackerTarget.com Vulnerability Scan options are Free (limit of 4 / day) Server / IP Web Sites Intelligence CMS Nmap Port Scan WhatWeb Site Fingerprint DomainProfiler WordPress Scan OpenVas Scan SQL Injection Test Fierce Domain Scan Joomla Scan SSL Check Nikto Web Scan Hosting Server Info Drupal Scan BlindElephant Scan Professional Services Security Scanning Membership Manual Security Assessment additional scanning ($7 / month or $49 / year) professional assessment with full report (from $400 USD) This report is autogenerated using various sources and scripts. No guarantee is made to the accuracy of the information found. See http://hackertarget.com for full Terms of Service. Design and Layout is licensed under a Creative Commons Attribution 3.0 Unported License. Joomla Security Scan by HackerTarget.com LLC 1 of 10
Table of Content Joomla Security Report HackerTarget.com Table of Content Joomla Site Info Domain Reputation Check Robots.txt found Site Links and Scripts External Site Links Javascript links and Scripts found Internal Site Links Hosting Information for www.joomla.org Websites sharing your IP Appendix A : Additional Resources The Basics Advanced Security Testing Further Information 1 1 2 3 3 4 5 5 7 8 9 9 10 10 10 10 Joomla Security Scan by HackerTarget.com LLC 2 of 10
This report is based on an automated security scan using passive data collection after crawling the nominated site. It was generated on Mon Aug 8 19:48:06 2011 More Information Joomla Site Info Site URI: Joomla Version: www.joomla.org/ unknown Advanced version fingerprinting can be done with blindelephant. Always ensure your Joomla software is up to date. Web Server: X-Powered-By: MetaGenerator: Page Title: Apache PHP/5.3.6 Joomla! 1.5 - Open Source Content Management Joomla! Domain Reputation Check The site www.joomla.org has been checked against web reputation services Ref Service Site Check Result Google Safebrowsing finds this site as safe Norton SafeWeb determines this site to be Safe SAFE SAFE MyWot has rated the sites trustworthiness as Excellent 94 Joomla Security Scan by HackerTarget.com LLC 3 of 10
Robots.txt found The robots.txt is used to tell search engines to ignore parts of your site. It can also be used by attackers to find stuff you may not want to be public and other interesting directories. raw file User-agent: * Disallow: /administrator/ Disallow: /cache/ Disallow: /components/ Disallow: /images/ Disallow: /includes/ Disallow: /installation/ Disallow: /language/ Disallow: /libraries/ Disallow: /media/ Disallow: /modules/ Disallow: /plugins/ Disallow: /templates/ Disallow: /tmp/ Disallow: /xmlrpc/ Joomla Security Scan by HackerTarget.com LLC 4 of 10
Site Links and Scripts Links and scripts to external sites and unknown javascript may indicate the presence of malware or malicious scripting. Examine the results below, linking to sites of poor reputation or malware can result in blacklisting by google and other search engines. External Site Links Links to external sites, assessed for reputation link Google Safe Browse MyWOT Reputation http://api.joomla.org/ SAFE 90 http://click.linksynergy.com/fs-bin/click?id=xy0hocdtu4s&offerid=145238.1405647&type=2&subid=0 SAFE 66 http://community.joomla.org SAFE 93 http://community.joomla.org/ SAFE 93 http://community.joomla.org/blogs/community.html SAFE 93 http://community.joomla.org/blogs/community/1476-who-is-joomla-jenkins.html SAFE 93 http://community.joomla.org/blogs/community/1477-skydeck.html SAFE 93 http://community.joomla.org/connect.html SAFE 93 http://community.joomla.org/connect/social.html SAFE 93 http://community.joomla.org/events.html SAFE 93 http://community.joomla.org/events/about.html SAFE 93 http://community.joomla.org/events/joomla-days/1405-joomla-day-south-africa-cape-town-2011.html SAFE 93 http://community.joomla.org/events/joomla-days/1413-joomla-day-bosnia-and-herzegovina-2011.html SAFE 93 http://community.joomla.org/events/joomla-days/1446-joomla-day-chicago-2011.html SAFE 93 http://community.joomla.org/events/joomla-days/975-joomladay-charter.html SAFE 93 http://community.joomla.org/showcase SAFE 93 http://community.joomla.org/showcase/ SAFE 93 http://community.joomla.org/showcase/how-to-submit-a-site.html SAFE 93 http://community.joomla.org/showcase/sites-of-the-month.html SAFE 93 http://community.joomla.org/showcase/sites/advsearch.html SAFE 93 http://community.joomla.org/showcase/sites/new.html SAFE 93 http://community.joomla.org/translations.html SAFE 93 http://community.joomla.org/translations/translation-policy.html SAFE 93 http://community.joomla.org/user-groups.html SAFE 93 http://community.joomla.org/user-groups/jug-information.html SAFE 93 http://contribute.joomla.org SAFE 94 http://demo.joomla.org SAFE 93 http://demo.joomla.org/ SAFE 93 http://developer.joomla.org SAFE 93 http://developer.joomla.org/ SAFE 93 http://developer.joomla.org/security.html SAFE 93 http://developer.joomla.org/security/news.html SAFE 93 http://docs.joomla.org SAFE 93 http://docs.joomla.org/ SAFE 93 http://docs.joomla.org/administrators SAFE 93 http://docs.joomla.org/beginners SAFE 93 http://docs.joomla.org/category:cookie_jar SAFE 93 http://docs.joomla.org/category:development SAFE 93 http://docs.joomla.org/category:faq SAFE 93 http://docs.joomla.org/category:tips_and_tricks SAFE 93 Joomla Security Scan by HackerTarget.com LLC 5 of 10
http://docs.joomla.org/cookie_jar SAFE 93 http://docs.joomla.org/developer_email_lists SAFE 93 http://docs.joomla.org/developers SAFE 93 http://docs.joomla.org/development_working_group SAFE 93 http://docs.joomla.org/documentation_working_group SAFE 93 http://docs.joomla.org/evaluators SAFE 93 http://docs.joomla.org/help_screens SAFE 93 http://docs.joomla.org/joomla!_extension_directory_faqs SAFE 93 http://docs.joomla.org/portal:bug_squad SAFE 93 http://docs.joomla.org/start_here SAFE 93 http://docs.joomla.org/template SAFE 93 http://docs.joomla.org/tutorial:creating_a_basic_joomla!_template SAFE 93 http://docs.joomla.org/web_designers SAFE 93 http://docs.joomla.org/index.php?title=special:userlogin&type=signup&returnto=main_page SAFE 93 http://extensions.joomla.org SAFE 93 http://extensions.joomla.org/ SAFE 93 http://extensions.joomla.org/extensions SAFE 93 http://extensions.joomla.org/extensions/advanced-search SAFE 93 http://extensions.joomla.org/extensions/languages/translations-for-joomla SAFE 93 http://extensions.joomla.org/extensions/new SAFE 93 http://feeds.joomla.org/~r/joomlacommunitycoreteamblog/~3/z2nw1pokbya/1474-joint-summitreport.html http://feeds.joomla.org/~r/joomlacommunitycoreteamblog/~3/m40dh7b83dc/1478-summary-of-thecommunity-leadership-team-summit.html http://feeds.joomla.org/~r/joomlacommunitycoreteamblog/~3/pui3n4uzwke/1475-report-from-theopen-source-matters-summit-san-jose-2011.html SAFE 88 SAFE 88 SAFE 88 http://feeds.joomla.org/~r/joomlasecuritynews/~3/4kdvsjzrivs/357-20110701-xss-vulnerability.html SAFE 88 http://forum.joomla.org SAFE 94 http://forum.joomla.org/ SAFE 94 http://forum.joomla.org/ucp.php?mode=register SAFE 94 http://forum.joomla.org/ucp.php?mode=sendpassword SAFE 94 http://forum.joomla.org/viewforum.php?f=11 SAFE 94 http://forum.joomla.org/viewforum.php?f=199 SAFE 94 http://forum.joomla.org/viewforum.php?f=262 SAFE 94 http://forum.joomla.org/viewforum.php?f=303 SAFE 94 http://forum.joomla.org/viewforum.php?f=304 SAFE 94 http://forum.joomla.org/viewforum.php?f=306 SAFE 94 http://forum.joomla.org/viewforum.php?f=364 SAFE 94 http://forum.joomla.org/viewforum.php?f=428 SAFE 94 http://forum.joomla.org/viewforum.php?f=429 SAFE 94 http://forum.joomla.org/viewforum.php?f=430 SAFE 94 http://forum.joomla.org/viewforum.php?f=431 SAFE 94 http://forum.joomla.org/viewforum.php?f=432 SAFE 94 http://forum.joomla.org/viewforum.php?f=433 SAFE 94 http://forum.joomla.org/viewforum.php?f=466 SAFE 94 http://forum.joomla.org/viewforum.php?f=47 SAFE 94 http://forum.joomla.org/viewforum.php?f=470 SAFE 94 http://forum.joomla.org/viewforum.php?f=508&sid=13fc581fa4ba3f0b1c0094cddd7d4378 SAFE 94 http://forum.joomla.org/viewforum.php?f=511 SAFE 94 http://forum.joomla.org/viewforum.php?f=542 SAFE 94 http://forum.joomla.org/viewforum.php?f=544 SAFE 94 http://forum.joomla.org/viewforum.php?f=562 SAFE 94 Joomla Security Scan by HackerTarget.com LLC 6 of 10
http://forum.joomla.org/viewforum.php?f=563 SAFE 94 http://forum.joomla.org/viewforum.php?f=7 SAFE 94 http://forum.joomla.org/viewtopic.php?f=8&t=65 SAFE 94 http://groups.google.com/group/joomla-commits/topics SAFE 94 http://groups.google.com/group/joomla-dev-framework SAFE 94 http://groups.google.com/group/joomla-dev-general SAFE 94 http://groups.google.com/group/joomlabugsquad SAFE 94 http://help.joomla.org/content/category/48/268/302/ SAFE 93 http://help.joomla.org/ghop/feb2008/task020/joomla!%20core%20features%20v1.2.pdf SAFE 93 http://help.joomla.org/ghop/feb2008/task048/joomla_15_quickstart.pdf SAFE 93 http://ideas.joomla.org SAFE 90 http://joomlacode.org SAFE 93 http://joomlacode.org/gf/ SAFE 93 http://joomlacode.org/gf/account/?action=lostpassword SAFE 93 http://joomlacode.org/gf/project/ SAFE 93 http://joomlacode.org/gf/project/joomla/ SAFE 93 http://joomlacode.org/gf/project/joomla/frs/?action=frsreleasebrowse&frs_package_id=5696 SAFE 93 http://joomlacode.org/gf/project/joomla/tracker/ SAFE 93 http://joomlacode.org/gf/project/jtranslation/ SAFE 93 http://kontentdesign.com SAFE 99 http://magazine.joomla.org SAFE 91 http://magazine.joomla.org/ SAFE 91 http://opensourcematters.org SAFE 96 http://opensourcematters.org/contact.html SAFE 96 http://opensourcematters.org/index.php?option=com_content&view=article&id=56&itemid=155 SAFE 96 http://opensourcematters.org/news/181-thank-you-to-andrea-and-ole.html SAFE 96 http://opensourcematters.org/news/182-community-oversight-changes.html SAFE 96 http://opensourcematters.org/register-your-group.html SAFE 96 http://people.joomla.org SAFE 83 http://people.joomla.org/ SAFE 83 http://resources.joomla.org SAFE 96 http://resources.joomla.org/ SAFE 96 http://resources.joomla.org/directory/advsearch.html SAFE 96 http://resources.joomla.org/directory/new.html SAFE 96 http://resources.joomla.org/how-to-add-listings.html SAFE 96 http://shop.joomla.org SAFE 94 http://shop.joomla.org/ SAFE 94 http://shop.joomla.org/amazonca-bookstores.html SAFE 94 http://shop.joomla.org/amazoncom-bookstores.html SAFE 94 http://shop.joomla.org/amazoncouk-bookstores.html SAFE 94 http://shop.joomla.org/amazonde-bookstores.html SAFE 94 http://shop.joomla.org/amazonfr-bookstores.html SAFE 94 http://shop.joomla.org/faqs.html SAFE 94 http://www.opensourcematters.org SAFE 96 http://www.rochenhost.com/joomla-hosting SAFE 93 Javascript links and Scripts found Google Analytics Account ID : UA-544070-3 Internally Linked Javascript Joomla Security Scan by HackerTarget.com LLC 7 of 10
link /media/system/js/caption.js /media/system/js/mootools.js Internal Site Links The full site has not been crawled, these are the links from the main index page links / /17 /about-joomla/the-project.html /about-joomla/the-project/sponsorship.html /announcements.html /announcements/general-news/5384-joomla-community-magazine-august-2011.html /announcements/release-news/5380-joomla-170-released.html /announcements/release-news/5383-joomla-166-released.html /core-features.html /download.html /technical-requirements.html http://www.joomla.org http://www.joomla.org/ http://www.joomla.org/about-joomla.html http://www.joomla.org/about-joomla/contribute-to-joomla.html http://www.joomla.org/about-joomla/the-project.html http://www.joomla.org/about-joomla/the-project/code-of-conduct.html http://www.joomla.org/about-joomla/the-project/leadership-team.html http://www.joomla.org/about-joomla/the-project/mission-vision-and-values.html http://www.joomla.org/about-joomla/the-project/project-teams.html http://www.joomla.org/about-the-joomla-project/media-contact.html http://www.joomla.org/accessibility-statement.html http://www.joomla.org/announcements.html http://www.joomla.org/core-features.html http://www.joomla.org/download.html http://www.joomla.org/international-info.html http://www.joomla.org/login.html http://www.joomla.org/mailing-lists.html http://www.joomla.org/privacy-policy.html http://www.joomla.org/technical-requirements.html Joomla Security Scan by HackerTarget.com LLC 8 of 10
Hosting Information for www.joomla.org The following details about the server and hosting provider have been discovered. Domain: www.joomla.org IP: 206.123.111.172 Organization: AS Name: ISP: City: Country: Colo4Dallas LP COLO4 COLO4DALLAS LP Dallas United States Websites sharing your IP These sites have been found to be sharing the servers IP address link Google Safe Browse MyWOT Reputation www.joomla.org SAFE 94 Joomla Security Scan by HackerTarget.com LLC 9 of 10
Appendix A : Additional Resources Joomla is a stable and powerful content management system. A few simple steps can increase the security of the platform a great deal. The Basics * Back It Up - Be ready to lose it all at anytime. If you have an up to date backup restoring is much easier * Keep Joomla System up to date * Keep all Plugins and Modules up to date * Beware of untrusted Themes and Modules * Rename admin account to a non-generic name * Use strong passwords ( a dictionary word with a number after it is not a strong password! ) * Keep your password safe! Do not re-use it on other sites. * Ensure you have up to date AV on your Windows Machine. Malware collects passwords. * The underlying server must be well managed and in a secure state * VPS or Dedicated server? Set up server monitoring (http://www.ossec.net is a good start) Advanced Security Testing This report has been generated using automated scripts and tools, while it provides a good overview of the general security of the site and any obvious problems, it is far from a comprehensive security assessment. HackerTarget.com has a comprehensive security assessment offering that is in effect a simulated hacker attack against the target system. This assessment by its nature is much more aggressive than the automated review you are looking at now, and provides a full report with any security holes found along with recommendations for increasing the security of the system. Alternatively there is a collection of security tools available for free and online for testing at HackerTarget.com. Further Information There are a thousand and one guides for drupal security tips. Some of the best information is from the source. Security Checklist for Joomla.org Joomla Security Scan by HackerTarget.com LLC 10 of 10