# Vulnx 🕷️ Intelligent Bot That Detects Vulnerabilities In Multiple Types Of CMS (Wordpress, Joomla, Drupal, Prestashop...)

**URL:** <https://onehack.st/t/vulnx-intelligent-bot-that-detects-vulnerabilities-in-multiple-types-of-cms-wordpress-joomla-drupal-prestashop/62453>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [November 20, 2019, 10:03pm UTC](https://onehack.st/t/vulnx-intelligent-bot-that-detects-vulnerabilities-in-multiple-types-of-cms-wordpress-joomla-drupal-prestashop/62453 "2019-11-20T22:03:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [November 20, 2019, 10:03pm UTC](https://onehack.st/t/vulnx-intelligent-bot-that-detects-vulnerabilities-in-multiple-types-of-cms-wordpress-joomla-drupal-prestashop/62453/1 "2019-11-20T22:03:06Z")

</div>

[![](https://1.bp.blogspot.com/-C13I9k9_YhY/XdAd-D48ouI/AAAAAAAAQ1w/ScClItzDZwgAKoWZojs0nXIy0XvDvEpPgCNcBGAsYHQ/s640/vulnx_6.png)](https://1.bp.blogspot.com/-C13I9k9_YhY/XdAd-D48ouI/AAAAAAAAQ1w/ScClItzDZwgAKoWZojs0nXIy0XvDvEpPgCNcBGAsYHQ/s1600/vulnx_6.png)

**Vulnx** is An Intelligent Bot Auto [Shell Injector](https://github.com/anouarbensaad/vulnx/wiki/Usage#run-exploits) that detect vulnerabilities in multiple types of Cms, fast cms detection,informations gathering and vulnerabilitie Scanning of the target like subdomains, ipaddresses, country, org, timezone, region, ans and more …  
Instead of injecting each and every shell manually like all the other tools do, VulnX analyses the target website checking the presence of a vulnerabilitie if so the shell will be Injected.searching urls with [dorks](https://github.com/anouarbensaad/vulnx/wiki/Usage#searching-dorks) Tool.

[![](https://user-images.githubusercontent.com/23563528/60695392-7a645b80-9ed9-11e9-94fb-f6025594a9e3.gif) ](https://user-images.githubusercontent.com/23563528/60695392-7a645b80-9ed9-11e9-94fb-f6025594a9e3.gif)

_ **Features** _

- Detect cms (wordpress, joomla, prestashop, drupal, opencart, magento, lokomedia)
- Target informations gatherings
- Target Subdomains gathering
- Multi-threading on demand
- Checks for vulnerabilities
- Auto shell injector
- Exploit dork searcher
- [`Ports Scan`](https://user-images.githubusercontent.com/23563528/58365946-40a83a00-7ec3-11e9-87c5-055ed67109b7.jpg) High Level
- [`Dns`](https://user-images.githubusercontent.com/23563528/58365784-09388e00-7ec1-11e9-8a05-e71fa39f146d.png)-Servers Dump
- Input multiple target to scan.
- Dorks Listing by Name& by ExploitName.
- Export multiple target from Dorks into a logfile.

_ **DNS-Map-Results** _  
To do this,run a scan with the --dns flag and -d for subdomains. To generate a map of isetso.rnu.tn, you can run the command `vulnx -u isetso.rnu.tn --dns -d --output $PATH` in a new terminal.  
`$PATH` : Where the graphs results will be stored.

[![](https://1.bp.blogspot.com/-bZ6RNMNgO84/XdAePNQDxCI/AAAAAAAAQ14/_uFwVlZHUlALOaEgAt-RLM7rXjppcofxwCNcBGAsYHQ/s640/vulnx_7.gif)](https://1.bp.blogspot.com/-bZ6RNMNgO84/XdAePNQDxCI/AAAAAAAAQ14/_uFwVlZHUlALOaEgAt-RLM7rXjppcofxwCNcBGAsYHQ/s1600/vulnx_7.gif)

Let’s generates an image displaying target Subdomains,MX & DNS data.

_ **Exploits** _

[![](https://1.bp.blogspot.com/-yyaa7obQr-M/XdAeYWJ0LzI/AAAAAAAAQ18/alA3Y_F5Eio_f0ZSb-7bhYiIbWQGuryZQCNcBGAsYHQ/s640/vulnx_8.png)](https://1.bp.blogspot.com/-yyaa7obQr-M/XdAeYWJ0LzI/AAAAAAAAQ18/alA3Y_F5Eio_f0ZSb-7bhYiIbWQGuryZQCNcBGAsYHQ/s1600/vulnx_8.png)

**Joomla**

- [Com Jce](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Jwallpapers](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Jdownloads](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Jdownloads2](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Weblinks](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Fabrik](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Fabrik2](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Jdownloads Index](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Foxcontact](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Blog](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Users](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Ads Manager](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Sexycontactform](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Media](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Mod\_simplefileupload](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Facileforms](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com Facileforms](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Com extplorer](https://github.com/anouarbensaad/vulnx/blob/master/'#')

**Wordpress**

- [Simple Ads Manager](https://www.exploit-db.com/exploits/36614)
- [InBoundio Marketing](https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_inboundio_marketing_file_upload)
- [WPshop eCommerce](https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_wpshop_ecommerce_file_upload)
- [Synoptic](https://cxsecurity.com/issue/WLB-2017030099)
- [Showbiz Pro](https://www.exploit-db.com/exploits/35385)
- [Job Manager](https://www.exploit-db.com/exploits/45031)
- [Formcraft](https://www.exploit-db.com/exploits/30002)
- [PowerZoom](http://www.exploit4arab.org/exploits/399)
- [Download Manager](https://www.exploit-db.com/exploits/35533)
- [CherryFramework](https://www.exploit-db.com/exploits/45896)
- [Catpro](https://vulners.com/zdt/1337DAY-ID-20256)
- [Blaze SlideShow](https://0day.today/exploits/18500)
- [Wysija-Newsletters](https://www.exploit-db.com/exploits/33991)

**Drupal**

- [Add Admin](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Drupal BruteForcer](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Drupal Geddon2](https://github.com/anouarbensaad/vulnx/blob/master/'#')

**PrestaShop**

- [attributewizardpro](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [columnadverts](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [soopamobile](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [pk\_flexmenu](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [pk\_vertflexmenu](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [nvn\_export\_orders](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [megamenu](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [tdpsthemeoptionpanel](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [psmodthemeoptionpanel](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [masseditproduct](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [blocktestimonial](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [soopabanners](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [Vtermslideshow](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [simpleslideshow](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [productpageadverts](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [homepageadvertise](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [homepageadvertise2](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [jro\_homepageadvertise](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [advancedslider](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [cartabandonmentpro](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [cartabandonmentproOld](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [videostab](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [wg24themeadministration](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [fieldvmegamenu](https://github.com/anouarbensaad/vulnx/blob/master/'#')
- [wdoptionpanel](https://github.com/anouarbensaad/vulnx/blob/master/'#')

**Opencart**

- [Opencart BruteForce](https://github.com/anouarbensaad/vulnx/blob/master/'#')

_ **VulnxMode** _  
`NEW` vulnx now have an interactive mode. _ **URLSET** _

[![](https://1.bp.blogspot.com/-0P_Axu9kULE/XdAe8SnJRmI/AAAAAAAAQ2M/A_5psxhnVN8GDcCbPH2PtLcSEMQmCD_NACNcBGAsYHQ/s640/vulnx_9.gif)](https://1.bp.blogspot.com/-0P_Axu9kULE/XdAe8SnJRmI/AAAAAAAAQ2M/A_5psxhnVN8GDcCbPH2PtLcSEMQmCD_NACNcBGAsYHQ/s1600/vulnx_9.gif)

_ **DORKSET** _

[![](https://1.bp.blogspot.com/-5p_hEwFEiTI/XdAe3FWlgnI/AAAAAAAAQ2I/OABp2fqbRk0s4LZsr6-vewURKUjnhwq1ACNcBGAsYHQ/s640/vulnx_10.png)](https://1.bp.blogspot.com/-5p_hEwFEiTI/XdAe3FWlgnI/AAAAAAAAQ2I/OABp2fqbRk0s4LZsr6-vewURKUjnhwq1ACNcBGAsYHQ/s1600/vulnx_10.png)

_ **Available command line options** _  
[`READ VULNX WIKI`](https://github.com/anouarbensaad/vulnx/wiki/Usage)

```auto
usage: vulnx [options] -u --url url target -D --dorks search webs with dorks -o --output specify output directory -t --timeout http requests timeout -c --cms-info search cms info[themes,plugins,user,version..] -e --exploit searching vulnerability & run exploits -w --web-info web informations gathering -d --domain-info subdomains informations gathering -l, --dork-list list names of dorks exploits -n, --number-page number page of search engine(Google) -p, --ports ports to scan -i, --input specify domains to scan from an input file --threads number of threads --dns dns informations gathering

```

_ **Docker** _  
VulnX in DOCKER !!.

```auto
$ git clone https://github.com/anouarbensaad/VulnX.git$ cd VulnX$ docker build -t vulnx ./docker/$ docker run -it --name vulnx vulnx:latest -u http://example.com

```

run vulnx container in interactive mode

[![](https://1.bp.blogspot.com/-1N3TSfKxJsI/XdAfHaoc_UI/AAAAAAAAQ2U/gSrP7Aj8nMI8hAV080SKzyK7aBEjI8HDgCNcBGAsYHQ/s640/vulnx_11.png)](https://1.bp.blogspot.com/-1N3TSfKxJsI/XdAfHaoc_UI/AAAAAAAAQ2U/gSrP7Aj8nMI8hAV080SKzyK7aBEjI8HDgCNcBGAsYHQ/s1600/vulnx_11.png)

to view logfiles mount it in a volume like so:

```auto
$ docker run -it --name vulnx -v "$PWD/logs:/VulnX/logs" vulnx:latest -u http://example.com

```

change the [mounting directory](https://github.com/anouarbensaad/vulnx/blob/master/docker/Dockerfile#L46)..

```auto
VOLUME ["$PATH"]

```

_ **Install vulnx on Ubuntu** _

```auto
$ git clone https://github.com/anouarbensaad/vulnx.git$ cd VulnX$ chmod +x install.sh$ ./install.sh

```

Now run `vulnx`

[![](https://1.bp.blogspot.com/-Vqg-jD2_LhM/XdAfPksdoZI/AAAAAAAAQ2Y/SfrVaQ3aLhYh709MFlwz34LeHc0_23TjQCNcBGAsYHQ/s640/vulnx_12.gif)](https://1.bp.blogspot.com/-Vqg-jD2_LhM/XdAfPksdoZI/AAAAAAAAQ2Y/SfrVaQ3aLhYh709MFlwz34LeHc0_23TjQCNcBGAsYHQ/s1600/vulnx_12.gif)

_ **Install vulnx on Termux** _

```auto
$ pkg update$ pkg install -y git$ git clone http://github.com/anouarbensaad/vulnx$ cd vulnx$ chmod +x install.sh$ ./install.sh

```

[![](https://1.bp.blogspot.com/-dfDUjagtCRk/XdAfh6SzTwI/AAAAAAAAQ2k/oYMiyyKF4-IjyGu8gNOzziV4hRNVQXgzQCNcBGAsYHQ/s1600/58364091-98847800-7ea6-11e9-9a9a-c27717e4dda1.png)](https://1.bp.blogspot.com/-dfDUjagtCRk/XdAfh6SzTwI/AAAAAAAAQ2k/oYMiyyKF4-IjyGu8gNOzziV4hRNVQXgzQCNcBGAsYHQ/s1600/58364091-98847800-7ea6-11e9-9a9a-c27717e4dda1.png)

_ **Install vulnx in Windows** _

- [click here](https://github.com/anouarbensaad/vulnx/archive/master.zip) to download vulnx
- download and install python3
- unzip **vulnx-master.zip** in _ **c:/** _
- open the command prompt **cmd**.

```auto
> cd c:/vulnx-master> python vulnx.py

```

**example command with options : settimeout=3 , cms-gathering = all , -d subdomains-gathering , run --exploits**  
`vulnx -u http://example.com --timeout 3 -c all -d -w --exploit`

**example command for searching dorks : -D or --dorks , -l --list-dorks**  
`vulnx --list-dorks` return table of exploits name. `vulnx -D blaze` return urls found with blaze dork

_ **Versions** _

- [v1.9](https://github.com/anouarbensaad/vulnx/releases/tag/v1.9)
- [v1.8](https://github.com/anouarbensaad/vulnx/releases/tag/v1.8)
- [v1.7](https://github.com/anouarbensaad/vulnx/releases/tag/v1.7)
- [v1.6](https://github.com/anouarbensaad/vulnx/releases/tag/v1.6)
- [v1.5](https://github.com/anouarbensaad/vulnx/releases/tag/v1.5)
- [v1.4](https://github.com/anouarbensaad/vulnx/releases/tag/v1.4)
- [v1.3](https://github.com/anouarbensaad/vulnx/releases/tag/v1.3)
- [v1.2](https://github.com/anouarbensaad/vulnx/releases/tag/v1.2)
- [v1.1](https://github.com/anouarbensaad/vulnx/releases/tag/v1.1)

[https://github.com/anouarbensaad/vulnx](https://github.com/anouarbensaad/vulnx)

---

<div class="post-metadata">

**Author:** ![Nulled](https://onehack.st/user_avatar/onehack.st/nulled/32/23165_2.png) [@Nulled](https://onehack.st/u/Nulled)\
**Post date:** [November 21, 2019, 9:07am UTC](https://onehack.st/t/vulnx-intelligent-bot-that-detects-vulnerabilities-in-multiple-types-of-cms-wordpress-joomla-drupal-prestashop/62453/2 "2019-11-21T09:07:39Z")

</div>

helpful. 🕶🕶🕶🕶🕶