How to find the version of extensions used on a Joomla website without access to the backend?

Question

First of all, I would like to check myself:

• An extension is an aggregate of modules, plugins and components, right?

• If that is right, then modules, plugins and components have the same versions. Is this also true?

The problem is: As part of security research that I am conducting, I need to find out the versions of the extensions used on a (any) given Joomla site.

In simple cases, the version is already written like here:

JWallpapers - A lightweight yet powerful image gallery component with community building capabilities
 * 
 * @version 2.2.2 $Id: default.css 558 2010-12-16 12:29:41Z amazeika $
 * @package JWallpapers
 * @copyright Copyright (C) 2009 Arunas Mazeika, http://www.wextend.com. All rights reserved
 * @author Arunas Mazeika
 * @license GNU General Public License v2+ (GNU GPL v2+). See license.php
 * 
 */
#picture_container,#picture_right_content,#thumbs_right_section,#thumbs_left_section,#frontend_tagging_section,#pic_tags_section
    {
    float: left;
    border: none !important;
}

.jw_category_title {
    float: left;
    border: none !important;
} 

But how can I find out the version of an extension if there is no such record?

I also looked here but the answerer used a php-script. Is it possible for a usual user to run such a script?

Are there other ways to find out extension versions on Joomla sites?

---

Disclaimer: This is purely to research any possible security vulnerabilities within Joomla

UDP_1

I'm using a OWASP-ZAP to get the site's tree , I mean I get every single file in every single directory. Like this :.

So could any module, plugin or component leave a mark somewhere else(I mean not only in ,for example, components directory)?

Answer 1

As @Sharky said, you can check the extension versions by accessing their manifest files. Here are the path of those files for each type of extension :

Component :

../administrator/components/com_extension_name/extension_name.xml

Module :

../modules/mod_extension_name/mod_extension_name.xml

Plugin :

../plugins/plugin_type/extension_name/extension_name.xml

Template :

../templates/extension_name/templateDetails.xml

Answer 2

If you're not an administrator of the site, you can't have this information in full. If you know which extensions are installed, you can check their versions by accessing their manifest files. For example, you can find out Joomla! version by accessing administrator/manifests/files/joomla.xml file.

The closest you can get to finding out which extensions are installed is by compiling a list of as many extensions as you can find in the wild and writing a script to check if the manifest files exist on the website.

Answer 3

the extension is an aggregate of modules, plugins and components?

A extension, is not the combination of a component, module and plugin. This is what a package is

Plugins, Modules, Components, Templates are all types of extensions.

---

So if I'm right, than modules, plugins and components have the same versions. Is it also true?

No. They're all separate, so they'll use different versions.

---

But how to find out the version of extensions if there is no such a record?

In your Joomla backend (admin panel), go to Extensions >> Manage >> Manage.

This will give you a list of all installed extensions and their respective version.

Here is an example:

Answer 4

As Sharky says, if you don't have administrator access to the database, the best way to find out this information is from the publicly accessible files on the website such as the xml manifest files. The security on some websites does not permit you to view these files so this method is not always reliable.

Even when you do have access to the manifest files, not all versions of an extension use the same manifest file.

For some examples, see the code below where Akeeba Backup and JCE Editor use the same manifest file for all versions but for ChronoForms and Gantry Framework, you need to check several files to get the version number.

// Display Akeeba Version
echo "<div class='item'>Akeeba Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_akeeba/akeeba.xml");
if (isset($xml->version)) {
  echo "<div class='column'>$xml->version</div>";
} else {
  echo "<div class='column'>Unknown</div>";
}

// Display JCE Version
echo "<div class='item'>JCE Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_jce/jce.xml");
if (isset($xml->version)) {
  echo "<div class='column'>$xml->version</div>";
} else {
  echo "<div class='column'>Unknown</div>";
}

// Display ChronoForms Version
echo "<div class='item'>ChronoForms Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_chronoforms6/chronoforms6.xml");
if (isset($xml->version)) {
  //ChronoForms v6
  echo "<div class='column'>$xml->version</div>";
} else {
  $xml = simplexml_load_file($website . "/administrator/components/com_chronoforms5/chronoforms5.xml");
  if (isset($xml->version)) {
    //ChronoForms v5
    echo "<div class='column'>$xml->version</div>";
  } else {
    $xml = simplexml_load_file($website . "/administrator/components/com_chronoforms/chronoforms.xml");
    if (isset($xml->version)) {
      //ChronoForms v4
      echo "<div class='column'>$xml->version</div>";
    } else {
      $xml = simplexml_load_file($website . "/administrator/components/com_chronocontact/chronocontact.xml");
      if (isset($xml->version)) {
        //ChronoForms v3
        echo "<div class='column'>$xml->version</div>";
      } else {
        //Unknown
        echo "<div class='column'>Unknown</div>";
      }
    }
  }
}

// Display Gantry Version
echo "<div class='item'>Gantry Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_gantry5/gantry5.xml");
if (isset($xml->version)) {
  //Gantry v5
  echo "<div class='column'>$xml->version</div>";
} else {
  $xml = simplexml_load_file($website . "/administrator/components/com_gantry/gantry.xml");
  if (isset($xml->version)) {
    //Gantry v4
    echo "<div class='column'>$xml->version</div>";
  } else {
    $xml = simplexml_load_file($website . "/administrator/components/com_gantry/manifest.xml");
    if (isset($xml->version)) {
      //Gantry v3
      echo "<div class='column'>$xml->version</div>";
    } else {
      //Unknown
      echo "<div class='column'>Unknown</div>";
    }
  }
}

Answer 5

* Update * I posted this answer and then later checked the answers by Sharky and later, Neil Roberts, saying the .xml files are available. I tested this on one of my sites, so I was very surprised that this information is available and I will have to do something about that. I have left my original answer here for general reference and voted up the Answers by the others saying look for the manifest xml file in the component directories.

---

That information is not available to an end user or visitor to a website.

You will either need Administrator access to the back end of Joomla or access to run a database query and unless you have hacked the site you wont have that either.

As a public viewer of a website you are only going to be able to see what is available in the HTML being displayed. As explained in Lodder's answer Extensions are comprised of plugin, modules and components and for the most part they happen on the server side of things to build the pages that are then rendered and sent to your browser.

Some components may display a back link or 'powered by ....' text in the footer of a page, that is by deliberate action on their part in their code, but normally plugins and modules will barely leave any trace of themselves let alone their version. A plugin executed deep in the code of Joomla that changes a value from A to B isn't going get any credits at the bottom of a page like say people who work on a Movie get listed at the end.

You could analyse the HTML code of every page of a Joomla site and slowly build up a catalogue of breadcrumbs of evidence that an extension may or may not have had a hand in creating a page, but there would be no reliable version information. It would also take that long I would suggest you don't have that many breathes left in you.

Perhaps if you explain more about the the research you are doing and what your requirement is then perhaps people on here could suggest an alternative approach.