How can I programatically determine the Joomla version of a website on which I have no administration privileges?

Question

I am creating an audit tool using PHP where I can submit the url of a Joomla website and run a number of checks on the target website including determining the installed Joomla version number. I don't have any administration privileges on the target Joomla website or the server it resides on.

Can anyone tell me which files and file contents I need to check to be able to confidently predict the installed Joomla version without having any administration privileges on the target Joomla website?

I am interested not just in knowing if the website is Joomla 2.5 (for example) but also whether it is Joomla 2.5.18 or 2.5.19 etc so I know if it is being well maintained or not.

Answer 1

I think you have to download and install all Joomla versions and check which files are unique.

Also a good starting point is the index.html files in the different Joomla versions, there was a change of the content iirc.

Based on the comment of @brian-a-peat you can check the color of admin section.

thats maybe the best approach to check the checksum of the css files for example.

Next edit, good the XML would really give you a good starting point as long as it is not blocked.

for Joomla >=1.6 ?
administrator/manifests/libraries/joomla.xml
for Joomla <= 1.5
you could check some other xml files.

Answer 2

There's a nice article on Gavick regarding this:

https://www.gavick.com/magazine/how-to-check-the-version-of-joomla.html

which leads to this plugin for Chrome:

https://chrome.google.com/webstore/detail/joomla-version-check/nfbncfldblphagigkamkhnjnhjkdlnii

Which I just installed...it totally does what you want. There's a little Joomla logo in the address bar and if you click on it, it tells you the version of joomla that's running.

Answer 3

The version is stored inside the JVersion class. It is in /libraries/cms/version/version.php so may be you can parse it somehow.

Answer 4

You might choose to focus on dates rather than versions as such. E.g. if you look at the modification date in the headers for a common static file (e.g. maybe you might choose the jquery script file), it's likely to effectively tell you when that file was installed or packaged. You can compare that with the current date and/or the date of the last security release to get a pretty good idea of the maintenance status of the site.

There's a variety of ways the file date can get set, so this isn't 100 reliable, but it's mostly pretty good, and has the advantage of being applicable across many different kinds of servers and software.

Answer 5

You can check the default files on the local/remote joomla installation at

/administrator/components/com_admin/sql/updates/sqlazure /administrator/components/com_admin/sql/updates/mysql /administrator/components/com_admin/sql/updates/postgresql

These folders contains SQL updates which will help in fingerprinting the version.

For instance: Joomla 3.8.3 will have all sql updates for previous versions till

3.8.2-2017-10-14.sql

similarly, for version 3.4.3

3.4.0-2015-02-26.sql

if you want to run brute-force to identify the version, following is the list of sql files you might want to run against:

2.5.0-2011-12-06.sql 2.5.0-2011-12-16.sql 2.5.0-2011-12-19.sql 2.5.0-2011-12-20.sql 2.5.0-2011-12-21-1.sql 2.5.0-2011-12-21-2.sql 2.5.0-2011-12-22.sql 2.5.0-2011-12-23.sql 2.5.0-2011-12-24.sql 2.5.0-2012-01-10.sql 2.5.0-2012-01-14.sql 2.5.1-2012-01-26.sql 2.5.2-2012-03-05.sql 2.5.3-2012-03-13.sql 2.5.4-2012-03-18.sql 2.5.4-2012-03-19.sql 2.5.5.sql 2.5.6.sql 2.5.7.sql 3.0.0.sql 3.0.1.sql 3.0.2.sql 3.0.3.sql 3.1.0.sql 3.1.1.sql 3.1.2.sql 3.1.3.sql 3.1.4.sql 3.1.5.sql 3.2.0.sql 3.2.1.sql 3.2.2-2013-12-22.sql 3.2.2-2013-12-28.sql 3.2.2-2014-01-08.sql 3.2.2-2014-01-15.sql 3.2.2-2014-01-18.sql 3.2.2-2014-01-23.sql 3.2.3-2014-02-20.sql 3.3.0-2014-02-16.sql 3.3.0-2014-04-02.sql 3.3.4-2014-08-03.sql 3.3.6-2014-09-30.sql 3.4.0-2014-08-24.sql 3.4.0-2014-09-01.sql 3.4.0-2014-09-16.sql 3.4.0-2014-10-20.sql 3.4.0-2014-12-03.sql 3.4.0-2015-01-21.sql 3.4.0-2015-02-26.sql 3.5.0-2015-07-01.sql 3.5.0-2015-10-13.sql 3.5.0-2015-10-26.sql 3.5.0-2015-10-30.sql 3.5.0-2015-11-04.sql 3.5.0-2015-11-05.sql 3.5.0-2016-02-26.sql 3.5.0-2016-03-01.sql 3.5.1-2016-03-25.sql 3.5.1-2016-03-29.sql 3.6.0-2016-04-01.sql 3.6.0-2016-04-06.sql 3.6.0-2016-04-08.sql 3.6.0-2016-04-09.sql 3.6.0-2016-05-06.sql 3.6.0-2016-06-01.sql 3.6.0-2016-06-05.sql 3.6.3-2016-08-15.sql 3.6.3-2016-08-16.sql 3.7.0-2016-08-06.sql 3.7.0-2016-08-22.sql 3.7.0-2016-08-29.sql 3.7.0-2016-09-29.sql 3.7.0-2016-10-01.sql 3.7.0-2016-10-02.sql 3.7.0-2016-11-04.sql 3.7.0-2016-11-19.sql 3.7.0-2016-11-21.sql 3.7.0-2016-11-24.sql 3.7.0-2016-11-27.sql 3.7.0-2017-01-08.sql 3.7.0-2017-01-09.sql 3.7.0-2017-01-15.sql 3.7.0-2017-01-17.sql 3.7.0-2017-01-31.sql 3.7.0-2017-02-02.sql 3.7.0-2017-02-15.sql 3.7.0-2017-02-17.sql 3.7.0-2017-03-03.sql 3.7.0-2017-03-09.sql 3.7.0-2017-03-19.sql 3.7.0-2017-04-10.sql 3.7.0-2017-04-19.sql 3.7.3-2017-06-03.sql 3.7.4-2017-07-05.sql 3.8.0-2017-07-28.sql 3.8.0-2017-07-31.sql 3.8.2-2017-10-14.sql

This may not give you the exact version but atleast helps you to identify the major version.