CyberCheatsheets

DroopeScan Cheat Sheet

CMS scanner focused on Drupal, Silverstripe, and WordPress plugin enumeration.

Web Application SecuritycmsdrupalsilverstripeUpdated 2026-06-02

Overview

DroopeScan (droopescan) enumerates Drupal (and other supported CMS) versions, modules, themes, and interesting URLs. Use on authorized Drupal assessments alongside manual testing.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

pip install droopescan

or

git clone https://github.com/droope/droopescan.git
pip install -r droopescan/requirements.txt

Essential commands

Drupal scan

droopescan scan drupal -u https://target.example

Enumerate plugins (WordPress mode)

droopescan scan wordpress -u https://target.example -p popular

Common workflows

Drupal enumeration —

droopescan scan drupal -u https://target.example -t 32
droopescan scan drupal -u https://target.example -o json -O drupal_scan.json
droopescan scan drupal -u https://target.example --enumerate p,t,u

Threaded multi-target (from file) —

droopescan scan drupal -U urls.txt -t 16

Through proxy —

droopescan scan drupal -u https://target.example --proxy http://127.0.0.1:8080

Flags reference

scan drupal

Drupal scanner

scan wordpress

WordPress plugin scan

scan silverstripe

Silverstripe scanner

-u URL

Single URL

-U FILE

URL list file

-t N

Threads

--enumerate

p (plugins), t (themes), u (users)

-o json

JSON output

-O FILE

Output file

--proxy

Proxy URL

-p

Plugin set (wordpress)

Tips

  • Drupal 8+ paths differ; ensure droopescan version supports target major version.
  • Enumerated modules often map to known CVEs—verify version strings in /CHANGELOG.txt or headers manually.
  • Use JSON output (-o json) for reporting pipelines.

References

Chuletas relacionadas