Others

Fingerprint first

# https://github.com/projectdiscovery/httpx
httpx -u https://example.com -tech-detect -title -server

# https://github.com/urbanadventurer/WhatWeb
whatweb -a 3 https://example.com

# https://github.com/Tuhinshubhra/CMSeeK
python3 cmseek.py -u https://example.com

Then look the version up before touching anything else. Most CMS findings are a known CVE, not a novel bug.

Joomla

joomscan

/administrator/          /README.txt          /web.config.txt
/administrator/manifests/files/joomla.xml     ← version
/language/en-GB/en-GB.xml                     ← version
/plugins/  /components/  /modules/

Magento

magescan

/magento_version         /downloader/         /rss/order/new
/admin  /index.php/admin
/app/etc/local.xml       ← credentials, if exposed

Magento 1 is end-of-life and still deployed. Check for Magecart-style skimmers and the known RCE chains.

Typo3

/typo3/         /typo3conf/         /t3-assets/
/typo3/sysext/core/Documentation/          ← version

Ghost / Craft / Umbraco / Sitecore

Ghost      /ghost/          /ghost/api/v3/admin/site/
Craft      /admin           /cpresources/
Umbraco    /umbraco         /umbraco/ping.aspx      ← version
Sitecore   /sitecore/login  /sitecore/shell/        (SXA CVEs)

Adobe Experience Manager

Big surface, frequently misconfigured. See also Web Technologies.

/crx/de/index.jsp        /system/console        /bin/querybuilder.json
/etc.json  /content.json  /libs.json            ← dispatcher bypass
/.json  /..json  /...4.2.1...json

# https://github.com/0ang3el/aem-hacker
python3 aem_hacker.py -u https://example.com --host YOUR_IP

SharePoint

/_layouts/15/            /_api/web/lists
/_vti_bin/               /_layouts/viewlsts.aspx

Headless / JAMstack

Modern sites often have no CMS on the origin at all. The CMS is a separate SaaS host.

Strapi     /admin  /api  /documentation
Directus   /admin  /server/info
Contentful, Sanity, Prismic → look for the API token in the JS bundle
Next.js    /_next/static/  /api/  (see webtech)

An exposed write token for a headless CMS is content injection on the main site.

Look for CVEs under the CMS

https://sploitus.com/

# https://github.com/projectdiscovery/nuclei
nuclei -u https://example.com -t http/cves/ -t http/exposures/ -severity critical,high

URL	Description
https://sploitus.com/	Exploit search
https://www.exploit-db.com/	Classic
https://github.com/projectdiscovery/nuclei-templates	Templates by product
https://wpscan.com/	See Wordpress