# SamJoan/droopescan

A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstripe.

Repository: https://github.com/SamJoan/droopescan
Canonical: https://ross.abutalabs.com/products/droopescan
Language: HTML
License: AGPL-3.0
License Family: copyleft
Last push: 2024-01-19T19:58:03+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 4333, "days_push": 957, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1445, forks 273 (observed 2026-08-28T04:04:45.108478+00:00)

## What it is
Droopescan is a plugin-based command-line scanner that helps security researchers identify the CMS, version, plugins, themes, and interesting URLs of target websites. It primarily supports Drupal and SilverStripe, with WordPress support and partial support for Joomla and Moodle.

## Use cases
- identify which CMS a website is running
- enumerate Drupal modules and themes on a target site
- fingerprint the version of a Drupal or Silverstripe installation
- find interesting URLs like admin login pages and changelog files during a pentest
- audit my own CMS site for exposed plugin directories
- scan multiple CMS sites from a list of URLs

## When to choose
- you need CMS-specific fingerprinting for Drupal or SilverStripe
- you are a security researcher doing authorized reconnaissance of CMS-based sites
- you want a scriptable CLI scanner that integrates into pentest workflows

## When to avoid
- you need a general-purpose web vulnerability scanner like a full DAST tool
- you require active exploitation or automated vulnerability correlation - droopescan only enumerates, correlation is manual
- you need support for CMSs beyond the ones listed, or deep Joomla/Moodle scanning
- scanning targets without explicit authorization - doing so is illegal

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, vulnerability-scanning, penetration-testing, web-scraping
- domain: security, penetration-testing, web-development, developer-tools
- platform: python, cli, windows
- tags: cms-scanner, drupal, silverstripe, wordpress, joomla, moodle, security-research, reconnaissance, plugin-based, linux, macos

## Member repositories
- SamJoan/droopescan (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:45.108478+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:36:12.750661+00:00, confidence not recorded.
  - readme: https://github.com/SamJoan/droopescan (fetched 2026-08-28T04:04:45.108478+00:00, sha a5abe2387252)
- Data as of 2026-08-30T08:39:29.467469+00:00.