10

I am creating an audit tool using PHP where I can submit the url of a Joomla website and run a number of checks on the target website including determining the installed Joomla version number. I don't have any administration privileges on the target Joomla website or the server it resides on.

Can anyone tell me which files and file contents I need to check to be able to confidently predict the installed Joomla version without having any administration privileges on the target Joomla website?

I am interested not just in knowing if the website is Joomla 2.5 (for example) but also whether it is Joomla 2.5.18 or 2.5.19 etc so I know if it is being well maintained or not.

  • You are doing it from the external script? – Dmitry Rekun Apr 23 '14 at 12:11
  • 1
    I'm using the comment because it's not a true technical answer, but if you just want the base number 1.5, 2.5, 3.x then you can try to view the admin and see the color or style of the admin page. That's how I can spot a 1.5 site easily. – Brian Peat Apr 23 '14 at 12:13
  • Yes. The form and script will run on a Joomla website and try to analyse an unrelated Joomla website. – Neil Robertson Apr 23 '14 at 12:14
  • Thanks Brian, this prompts me to clarify the question a little bit. – Neil Robertson Apr 23 '14 at 12:15
  • Also see joomla.stackexchange.com/a/7187/120 posted by @Lodder – Neil Robertson Jan 25 '15 at 0:01
9

I think you have to download and install all Joomla versions and check which files are unique.

Also a good starting point is the index.html files in the different Joomla versions, there was a change of the content iirc.

Based on the comment of @brian-a-peat you can check the color of admin section.

thats maybe the best approach to check the checksum of the css files for example.

Next edit, good the XML would really give you a good starting point as long as it is not blocked.

for Joomla >=1.6 ?
administrator/manifests/libraries/joomla.xml
for Joomla <= 1.5
you could check some other xml files.
  • 3
    The XML files in extensions is probably one of the most accurate ways of determining version differences. However, it's possible some hosts lock those down with htaccess so you'll still need some kind of plan B. – Andrew Eddie Apr 23 '14 at 12:17
  • 1
    You are right Andrew, there is a question about this joomla.stackexchange.com/questions/148/… so you can also check the language files, there you find the copyright date that can help to guess the version. – Harald Leithner Apr 23 '14 at 12:20
  • Thanks Andrew, this helps! I'm not expecting to receive 100% accuracy e.g. when site XML files are locked down via .htaccess – Neil Robertson Apr 23 '14 at 12:20
  • 1
    So administrator/manifests/libraries/joomla.xml could help you. – Harald Leithner Apr 23 '14 at 12:21
4

There's a nice article on Gavick regarding this:

https://www.gavick.com/magazine/how-to-check-the-version-of-joomla.html

which leads to this plugin for Chrome:

https://chrome.google.com/webstore/detail/joomla-version-check/nfbncfldblphagigkamkhnjnhjkdlnii

Which I just installed...it totally does what you want. There's a little Joomla logo in the address bar and if you click on it, it tells you the version of joomla that's running.

  • Thanks Brian, the Gavick article is exactly the type of information I am looking for although it's missing the latest information for Joomla 3.x. There is also a "Joomla Version Check" add-on for FireFox which works well and I am already using but ideally I am keen to develop my own solution so I can enter a batch of urls and check some other things at the same time. – Neil Robertson Apr 23 '14 at 12:30
4

The version is stored inside the JVersion class. It is in /libraries/cms/version/version.php so may be you can parse it somehow.

  • 4
    Wouldn't work because he will not get the content from extern. – Harald Leithner Apr 23 '14 at 12:32
1

You might choose to focus on dates rather than versions as such. E.g. if you look at the modification date in the headers for a common static file (e.g. maybe you might choose the jquery script file), it's likely to effectively tell you when that file was installed or packaged. You can compare that with the current date and/or the date of the last security release to get a pretty good idea of the maintenance status of the site.

There's a variety of ways the file date can get set, so this isn't 100 reliable, but it's mostly pretty good, and has the advantage of being applicable across many different kinds of servers and software.

1

You can check the default files on the local/remote joomla installation at

/administrator/components/com_admin/sql/updates/sqlazure /administrator/components/com_admin/sql/updates/mysql /administrator/components/com_admin/sql/updates/postgresql

These folders contains SQL updates which will help in fingerprinting the version.

For instance: Joomla 3.8.3 will have all sql updates for previous versions till

3.8.2-2017-10-14.sql

similarly, for version 3.4.3

3.4.0-2015-02-26.sql

if you want to run brute-force to identify the version, following is the list of sql files you might want to run against:

2.5.0-2011-12-06.sql 2.5.0-2011-12-16.sql 2.5.0-2011-12-19.sql 2.5.0-2011-12-20.sql 2.5.0-2011-12-21-1.sql 2.5.0-2011-12-21-2.sql 2.5.0-2011-12-22.sql 2.5.0-2011-12-23.sql 2.5.0-2011-12-24.sql 2.5.0-2012-01-10.sql 2.5.0-2012-01-14.sql 2.5.1-2012-01-26.sql 2.5.2-2012-03-05.sql 2.5.3-2012-03-13.sql 2.5.4-2012-03-18.sql 2.5.4-2012-03-19.sql 2.5.5.sql 2.5.6.sql 2.5.7.sql 3.0.0.sql 3.0.1.sql 3.0.2.sql 3.0.3.sql 3.1.0.sql 3.1.1.sql 3.1.2.sql 3.1.3.sql 3.1.4.sql 3.1.5.sql 3.2.0.sql 3.2.1.sql 3.2.2-2013-12-22.sql 3.2.2-2013-12-28.sql 3.2.2-2014-01-08.sql 3.2.2-2014-01-15.sql 3.2.2-2014-01-18.sql 3.2.2-2014-01-23.sql 3.2.3-2014-02-20.sql 3.3.0-2014-02-16.sql 3.3.0-2014-04-02.sql 3.3.4-2014-08-03.sql 3.3.6-2014-09-30.sql 3.4.0-2014-08-24.sql 3.4.0-2014-09-01.sql 3.4.0-2014-09-16.sql 3.4.0-2014-10-20.sql 3.4.0-2014-12-03.sql 3.4.0-2015-01-21.sql 3.4.0-2015-02-26.sql 3.5.0-2015-07-01.sql 3.5.0-2015-10-13.sql 3.5.0-2015-10-26.sql 3.5.0-2015-10-30.sql 3.5.0-2015-11-04.sql 3.5.0-2015-11-05.sql 3.5.0-2016-02-26.sql 3.5.0-2016-03-01.sql 3.5.1-2016-03-25.sql 3.5.1-2016-03-29.sql 3.6.0-2016-04-01.sql 3.6.0-2016-04-06.sql 3.6.0-2016-04-08.sql 3.6.0-2016-04-09.sql 3.6.0-2016-05-06.sql 3.6.0-2016-06-01.sql 3.6.0-2016-06-05.sql 3.6.3-2016-08-15.sql 3.6.3-2016-08-16.sql 3.7.0-2016-08-06.sql 3.7.0-2016-08-22.sql 3.7.0-2016-08-29.sql 3.7.0-2016-09-29.sql 3.7.0-2016-10-01.sql 3.7.0-2016-10-02.sql 3.7.0-2016-11-04.sql 3.7.0-2016-11-19.sql 3.7.0-2016-11-21.sql 3.7.0-2016-11-24.sql 3.7.0-2016-11-27.sql 3.7.0-2017-01-08.sql 3.7.0-2017-01-09.sql 3.7.0-2017-01-15.sql 3.7.0-2017-01-17.sql 3.7.0-2017-01-31.sql 3.7.0-2017-02-02.sql 3.7.0-2017-02-15.sql 3.7.0-2017-02-17.sql 3.7.0-2017-03-03.sql 3.7.0-2017-03-09.sql 3.7.0-2017-03-19.sql 3.7.0-2017-04-10.sql 3.7.0-2017-04-19.sql 3.7.3-2017-06-03.sql 3.7.4-2017-07-05.sql 3.8.0-2017-07-28.sql 3.8.0-2017-07-31.sql 3.8.2-2017-10-14.sql

This may not give you the exact version but atleast helps you to identify the major version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.