How to add authentication for Drupal Scanning site?

[indhu85]

Hi,

How to add authentication to scanning drupal website?

For eg:

python droopescan/droopescan scan drupal -u https://www.XXXXXXXXXXX.org/user/ --output json -e p

Its returns as "The site is not running Drupal"

Anyone share me the steps to authenticate into drupal website in droopescan.

[SamJoan]

hi @indhu85,

There's a section on authentication on the README, but I'm not sure that will help you in this case. I would try removing /user/ from the URL, e.g. https://www.xxxxxxxxxxx.org/ instead of https://www.xxxxxxxxxxx.org/user/.

If you're still having issues, please provide the output for the site with the --debug-requests command line flag and I'll have a look for you.

Thanks, Sam

[indhu85]

Hi @SamJoan,

Without "user" in the URL, I can able to get list of modules and themes.

1. Is droopescan not using authentication to get these list(modules and themes) from secured drupal website?
2. Is the list contain only active modules or it include inactive modules also?
3. Is there any method in droopescan to export a configuration used in website

Thanks, @indhu85

[SamJoan]

Hi,

droopescan does indeed not use authentication to identify list of modules and themes. The way these are identified is through wordlists and bruteforcing URLs. For example, droopescan may perform a request to sites/all/modules/cktoolkit and observe whether a HTTP 200 response is detected.

The wordlist that is used is obtained from each CMS' addon download page. I refresh this annually approximately in case new popular addons have been created.

You can export the results in JSON format, check out the output section of the README.

[indhu85]

Hi @SamJoan ,

Is the returned droopescan plugin list contains only active modules or it include inactive(disabled) modules also?

[SamJoan]

I would have to look into this but I believe that droopescan returns both active and inactive plugins.