Drupal
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2Fpentest.eu%2FRENDER_WebSec_10fps_21sec_9MB_29042024.gif&width=768&dpr=4&quality=100&sign=bc0743d1&sv=1)
Discovery
Check meta
Node: Drupal indexes its content using nodes. A node can hold anything such as a blog post, poll, article, etc. The page URIs are usually of the form
/node/<nodeid>
.
Enumeration
Drupal supports three types of users by default:
Administrator
: This user has complete control over the Drupal website.Authenticated User
: These users can log in to the website and perform operations such as adding and editing articles based on their permissions.Anonymous
: All website visitors are designated as anonymous. By default, these users are only allowed to read posts.
Version
Check
/CHANGELOG.txt
Newer installs of Drupal by default block access to the CHANGELOG.txt
and README.txt
files.
Username enumeration
Register
In /user/register just try to create a username and if the name is already taken it will be notified:
Request new password
If you request a new password for an existing username:
If you request a new password for a non-existent username:
Get number of users
Accessing /user/<number> you can see the number of existing users, in this case is 2 as /users/3 returns a not found error:
Hidden pages
Fuzz /node/$
where $
is a number (from 1 to 500 for example).
You could find hidden pages (test, dev) which are not referenced by the search engines.
Installed modules info
Automatic
RCE
If you have access to the Drupal web console check these options to get RCE:
Drupal RCEFrom XSS to RCE
Drupalwned: Drupal Exploitation Script that elevate XSS to RCE or Others Critical Vulnerabilities. For more info check this post. It provides support for Drupal Versions 7.X.X, 8.X.X, 9.X.X and 10.X.X, and allows to:
Privilege Escalation: Creates an administrative user in Drupal.
(RCE) Upload Template: Upload custom templates backdoored to Drupal.
Post Exploitation
Read settings.php
Dump users from DB
References
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2Fpentest.eu%2FRENDER_WebSec_10fps_21sec_9MB_29042024.gif&width=768&dpr=4&quality=100&sign=bc0743d1&sv=1)
Last updated