cmseek

No entries match these filters. Clear filters

1. docs update Oct 4, 2026 · issue 094

   Adds --light-scan and --only-cms (-o) CLI arguments, and WordPress brute-force via XML-RPCXML-RPCA remote procedure call protocol that encodes calls and responses as XML over HTTP, letting a client invoke functions on a remote server without a custom binary protocol..

   • Adds --light-scan argument to enable a lighter scanning mode.
   • Adds --only-cms (-o) argument to limit scans to CMS identification only.
   • Adds WordPress brute-force capability via XML-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets..

   3 details in Everything

   • New detection New CMS fingerprints
   • New detection Version detection for Amiro.CMS and GoDaddy Website Builder
   • Updated integration WordPress vulnerability source switched to wpvulns.com
2. docs update Sep 15, 2026 · issue 075

   CMSeeK 1.1.3 adds 12 new CMS detections, WordPress XML-RPCXML-RPCA remote procedure call protocol that encodes calls and responses as XML over HTTP, letting a client invoke functions on a remote server without a custom binary protocol. bruteforce, and new --light-scan and --only-cms flags⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run a fast, lightweight scan to identify only the CMS without deep enumeration — useful in large-scale reconnaissance where speed matters.
   copy

   $ python3 cmseek.py -u https://example.com --only-cms --light-scan

   • Adds --light-scan argument to limit scan depth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --only-cms (-o) argument to restrict results to CMS detection only.
   • Adds WordPress bruteforce capability via XML-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets..
   • Adds detection support for 12 new CMSes: Smartstore, Solusquare Commerce Cloud, Spree, Brightspot CMS, Amiro.CMS, Weebly, ekmPowershop, GoDaddy Website Builder, WHMCS, Zen Cart, OpenNemas CMS, and IPO CMS.
   • Adds version detection for Amiro.CMS and GoDaddy Website Builder.

   +1 more show less

   • Switches WordPress vulnerability lookups to wpvulns.com.
   • Adds --light-scan argument to limit scan depth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --only-cms (-o) argument to restrict results to CMS detection only.
   • Adds WordPress bruteforce capability via XML-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets..
   • Adds detection support for 12 new CMSes: Smartstore, Solusquare Commerce Cloud, Spree, Brightspot CMS, Amiro.CMS, Weebly, ekmPowershop, GoDaddy Website Builder, WHMCS, Zen Cart, OpenNemas CMS, and IPO CMS.

   2 more in Everything

3. docs update Sep 8, 2026 · issue 068

   CMSeeK gains an API mode — POST endpoint via Flask returns CMS scan results as JSON

   • Adds a POST API mode backed by Flask that returns CMS scan data as JSON without printing to the console.
   • Adds Silent flag to suppress output from the Results and Basics modules when running in API mode.
   • Adds Should_Return flag to instruct modules to return scan data as a dictionary instead of relying on console prints.
   • Extends Silent and Should_Return flags to deep-scan modules, giving API mode full coverage across scan depth levels.
   • Adds a POST API mode backed by Flask that returns CMS scan data as JSON without printing to the console.
   • Adds Silent flag to suppress output from the Results and Basics modules when running in API mode.
   • Adds Should_Return flag to instruct modules to return scan data as a dictionary instead of relying on console prints.

   1 more in Everything

4. 1.1.3 Jul 25, 2020 · release notes

   Adds WordPress XML-RPCXML-RPCA remote procedure call protocol that encodes calls and responses as XML over HTTP, letting a client invoke functions on a remote server without a custom binary protocol. brute force support, --light-scan and --only-cms CLI flags in CMSeeK 1.1.3

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1.3 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout 1.1.3

   • Added CMS detection for Smartstore, Solusquare Commerce Cloud, Spree, Brightspot CMS, Amiro.CMS, Weebly, ekmPowershop, GoDaddy Website Builder, WHMCS, Zen Cart, OpenNemas CMS, and IPO CMS
   • Added --light-scan CLI argument to enable a lightweight scanning mode
   • Added --only-cms (-o) flag to restrict output exclusively to CMS identification
   • Added WordPress version detection for Amiro.CMS and GoDaddy Website Builder
   • Switched the underlying WordPress vulnerability data source from the previous provider to wpvulns.com

   5 details in Everything

5. v.1.1.3 Jul 24, 2020 · release notes

   Adds Smartstore and Solusquare CMS detection, XML-RPCXML-RPCA remote procedure call protocol that encodes calls and responses as XML over HTTP, letting a client invoke functions on a remote server without a custom binary protocol. WordPress bruteforce, and --light-scan/--only-cms flags

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v.1.1.3 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout v.1.1.3

   └──▷ USE IT
   Run a quick scan to identify the CMS without performing deep enumeration or version checks.
   shell copy

   cmseek -u <target> --light-scan

   Perform only the CMS identification phase and skip all other modules.
   shell copy

   cmseek -u <target> --only-cms

   • Added --light-scan argument to reduce scan overhead.
   • Added new CMS detections for Smartstore, Solusquare Commerce Cloud, Spree, Brightspot CMS, Amiro.CMS, Weebly, ekmPowershop, GoDaddy Website Builder, WHMCS, Zen Cart, OpenNemas CMS, and IPO CMS.
   • Adds WordPress Bruteforce capability via XML-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets..

   3 details in Everything

6. v.1.1.2 May 19, 2019 · release notes

   CMSeeK v1.1.2 adds batch/strict modes, new CMS detections, and fixes JSON output

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v.1.1.2 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout v.1.1.2

   • Adds --batch, --ignore-cms, --strict-cms, and --skip-scanned CLI arguments for automated scanning workflows
   • Adds support for detecting Proximis Omnichannel, Quick.Cart, RBS Change, Salesforce Commerce Cloud, Sazito, Shopatron, Umbraco, Shoper, Shopery, ShopFA, Shopify, and Shoptet CMS platforms
   • Enables version detection for Quick.Cart, Oracle ATG Web Commerce, RBS Change, Umbraco, and ShopFA

   3 details in Everything

7. 1.1.2 May 19, 2019 · release notes

   CMSeeK 1.1.2 adds support for 12 new CMS platforms, version detection for several, and four CLI flags for workflow control.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1.2 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout 1.1.2

   • Added --batch argument to enable non-interactive mode
   • Added --ignore-cms argument to skip specific CMS types during scanning
   • Added --strict-cms argument to enforce strict CMS matching logic
   • Added --skip-scanned argument to omit already-detected targets from further processing
   • Added detection for the following new CMS platforms: Proximis Omnichannel, Quick.Cart, RBS Change, Salesforce Commerce Cloud, Sazito, Shopatron, Umbraco, Shoper, Shopery, ShopFA, Shopify, Shoptet

   +1 more show less

   • Added version detection capability for Quick.Cart, Oracle ATG Web Commerce, RBS Change, Umbraco, and ShopFA

   6 details in Everything

8. v.1.1.1 Feb 1, 2019 · release notes

   cmseek v1.1.1 adds --googlebot UA, redirect flags, and support for many new CMS platforms

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v.1.1.1 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout v.1.1.1

   └──▷ USE IT
   Bypass anti-bot protections by spoofing a Google crawler user agent during CMS identification scans.
   shell copy

   cmseek --url https://example.com --googlebot

   Force the tool to stop following redirect chains, useful for analyzing standalone landing pages.
   shell copy

   cmseek --url https://example.com/landing --no-redirect

   • Adds --googlebot flag to use the Googlebot user agent
   • Adds --follow-redirect and --no-redirect arguments to control HTTP redirection behavior
   • Adds detection for Afosto, Afterbuy, Arastta, BigCommerce, Bigware, Bizweb, Clientexec, CloudCart, ColormeShop, Moodle, ORKIS Ajaris Websuite, Comandia, Commerce Server, Cosmoshop, CS Cart, CubeCart, Al Mubda, Dynamicweb, EC-CUBE, Elcodi, ePages, eZ Publish, Fortune3, PrestaShop, and BigTree CMS
   • Adds version detection for Magento, Commerce Server, and Dynamicweb

   4 details in Everything

9. 1.1.1 Feb 1, 2019 · release notes

   cmseek 1.1.1 adds Googlebot user-agent support, redirect flags, and detection for 28 new CMS platforms.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.1.1 https://github.com/Tuhinshubhra/CMSeeK.git
   # already have the repo? check out this version:
   $ git checkout 1.1.1

   • Adds --googlebot option to use the Googlebot user agent
   • Adds --follow-redirect and --no-redirect arguments
   • Adds detection for Afosto, Afterbuy, Arastta, BigCommerce, Bigware, Bizweb, Clientexec, CloudCart, ColormeShop, Moodle, ORKIS Ajaris Websuite, Comandia, Commerce Server, Cosmoshop, CS Cart, CubeCart, Al Mubda, Dynamicweb, EC-CUBE, Elcodi, ePages, eZ Publish, Fortune3, PrestaShop, and BigTree CMS
   • Adds version detection for Magento, Commerce Server, and Dynamicweb

   4 details in Everything

10. v.1.1.0 Aug 28, 2018 · release notes

    CMSeeK v1.1.0 adds detection support for over 35 new forums and version numbers for many of them.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.1.0 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.1.0

    • cmseek now detects CMS content for Advanced Electron Forum, Arc Forum, AspNetForum, Burning Board, Beehive Forum, Discourse, Discuz!, Flarum, FluxBB, FUDforum, IPB Forum, JForum, MercuryBoard, miniBB, mvnForum, MyBB, mwForum, myUPB, NodeBB, NoNonsense Forum, Phorum, PunBB, SMF, UBB.threads, Vanilla, uKnowva, XenForo, XMB, YaBB, YAF, and Yazd.
    • cmseek now detects the CMS version for Advanced Electron Forum, AspNetForum, Burning Board, Beehive Forum, Discourse, Discuz!, FUDforum, JForum, MercuryBoard, miniBB, mvnForum, MyBB, myUPB, NodeBB, PunBB, SMF, UBB.threads, Vanilla, uKnowva, XMB, YaBB, and YAF.
    • cmseek now adds new detection methods for phpwind.

    3 details in Everything

11. v.1.0.9 Aug 21, 2018 · release notes

    Adds support for 21 new CMS platforms and version detection for 7 of them

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.0.9 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.0.9

    • cmseek now detects the following new CMS: PHP Nuke, FlexCMP, eZ Publish, ExpressionEngine, EPiServer, e107, DNN Platform, phpBB, DEDE CMS, Danneo CMS, Craft CMS, CPG Dragonfly, Cotonti, Orchard CMS, ContentBox, Contentful, Contensis CMS, CMS CONTENIDO, Contao, and Concrete5 CMS
    • Version detection added for FlexCMP, Danneo CMS, Contensis CMS, CMS CONTENIDO, Concrete5 CMS, CMSimple, and BrowserCMS
    • --ignore-certificate-error flag added to bypass SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate validation failures

    3 details in Everything

12. 1.0.9 Aug 21, 2018 · release notes

    CMSeeK 1.0.9 adds CMS detection for 20 platforms and version detection for 7 CMSes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.9 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout 1.0.9

    • Added detection support for PHP Nuke, FlexCMP, eZ Publish, ExpressionEngine, EPiServer, e107, DNN Platform, phpBB, DEDE CMS, Danneo CMS, Craft CMS, CPG Dragonfly, Cotonti, Orchard CMS, ContentBox, Contentful, Contensis CMS, CMS CONTENIDO, Contao, and Concrete5 CMS
    • Added version detection capability for FlexCMP, Danneo CMS, Contensis CMS, CMS CONTENIDO, Concrete5 CMS, CMSimple, and BrowserCMS
    • Added --ignore-ssl-errors flag (or equivalent logic) to bypass certificate validation errors

    3 details in Everything

13. 1.0.8 Aug 14, 2018 · release notes

    CMSeeK 1.0.8 adds detection for 36 new CMS platforms and version detection for 16 additional systems.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.8 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout 1.0.8

    • Adds support for detecting 36 new CMS platforms including SilverStripe, Microsoft SharePoint, GravCMS, and Pimcore
    • Adds version detection capability for Serendipity, SeamlessCMS, Rock RMS, RiteCMS, Roadiz CMS, phpWind, Quick.Cms, Ophal, Sitefinity, OpenText WSM, OpenCms, Microsoft SharePoint, Mura CMS, Kooboo CMS, Koken, Jimdo, and ImpressPages CMS
    • Adds new browser validation bypass mechanism to improve detection reliability

    3 details in Everything

14. v.1.0.8 Aug 13, 2018 · release notes

    CMSeeK v1.0.8 adds detection for 39 new CMS platforms and introduces a browser validation bypass feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.0.8 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.0.8

    • Adds support for detecting 39 new CMS platforms including SilverStripe, Silva CMS, Serendipity, SeamlessCMS, Rock RMS, Roadiz CMS, RiteCMS, RCMS, Quick.Cms, Pimcore, Percussion CMS, phpWind, phpCMS, PencilBlue, Ophal, Sitefinity, OpenText WSM, OpenCms, Odoo, Microsoft SharePoint, October CMS, Mura CMS, Moto CMS, Mono.net, MODX, Methode, Mambo, LiveStreet CMS, LEPTON CMS, HIPPO CMS, Kooboo CMS, Koken, IndexHibit, Webflow CMS, Jalios JCMS, ImpressPages CMS, Hotaru CMS, GravCMS, GetSimple CMS, and Fork CMS
    • Adds a new browser validation bypass mechanism

    2 details in Everything

15. v.1.0.7 Aug 7, 2018 · release notes

    Adds WordPress DeepScan path disclosure scan and theme zip check capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.0.7 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.0.7

    • cmseek now includes a path disclosure scan for WordPress as part of the updated DeepScan module
    • cmseek now performs a theme zip file check during WordPress deep scanning

    2 details in Everything

16. 1.0.7 Aug 7, 2018 · release notes

    CMSeeK 1.0.7 adds detection for 11 new CMS platforms and updates WordPress DeepScan.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.7 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout 1.0.7

    • Adds TiddlyWiki support to the --cms list
    • Adds SULU support to the --cms list
    • Adds Subrion CMS support to the --cms list
    • Adds Squiz Matrix support to the --cms list
    • Adds Spin CMS support to the --cms list

    +5 more show less

    • Adds solodev support to the --cms list
    • Adds sNews support to the --cms list
    • Adds sitecore support to the --cms list
    • Adds SIMsite support to the --cms list
    • Adds Simplébo support to the --cms list

    10 details in Everything

17. v.1.0.6 Jul 23, 2018 · release notes

    Adds support for 12 new CMS platforms and a --list flag to scan sites from a file

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.0.6 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.0.6

    └──▷ TRY IT
    Scan a list of target URLs stored in targets.txt without interactive prompts.
    copy

    $ cmseek -l targets.txt

    • Adds -l, --list argument for scanning sites from file
    • Added detection method for 8 new CMSs: XOOPS, Wolf CMS, Wix.com, WebGUI, UMI.CMS, ushahidi, Tiki Wiki CMS Groupware, WebsiteBaker CMS
    • Version detection added for 3 new CMSs: XpressEngine, WebGUI, UMI.CMS

    3 details in Everything

18. 1.0.6 Jul 23, 2018 · release notes

    Adds robots.txt-based detection, version detection for XpressEngine/WebGUI/UMI.CMS, (-l/--list) file scanning, and username injection in brute-forcing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.6 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout 1.0.6

    • Added (-l, --list) argument to scan a list of sites from a file.
    • Added CMS detection via robots.txt.
    • Added version detection for XpressEngine, WebGUI, and UMI.CMS.
    • Brute-forcer now injects the discovered username into the password dictionary.
    • Added support for XOOPS, Wolf CMS, Wix.com, WebGUI, UMI.CMS, ushahidi, Tiki Wiki CMS Groupware, and WebsiteBaker CMS.

    5 details in Everything

19. 1.0.5 Jul 19, 2018 · release notes

    Adds Drupal CMS detection support and switches to multithreading for better performance

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.5 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout 1.0.5

    • Added version detection for Drupal.
    • Replaced multiprocessing with multithreading to run on almost all devices.

    2 details in Everything

20. v.1.0.2 Jul 6, 2018 · release notes

    Adds passive WordPress theme/plugin detection, --random-agent flag, and verbose mode to CMSeeK.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.0.2 https://github.com/Tuhinshubhra/CMSeeK.git
    # already have the repo? check out this version:
    $ git checkout v.1.0.2

    └──▷ TRY IT
    Target a specific URL with a randomized user-agent and verbose logging to identify WordPress themes.
    copy

    $ cmseek.py --url https://example.com --random-agent --verbose

    Set a specific user-agent string to mimic a known browser during plugin enumeration.
    copy

    $ cmseek.py --url https://example.com --user-agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'

    • --url argument added for specifying the target URL
    • --user-agent argument added to set a custom User-Agent string
    • --random-agent argument added to rotate user agents automatically
    • --verbose flag added for detailed output
    • Support for passive WordPress theme detection enabled

    +1 more show less

    • Support for passive WordPress plugin enumeration enabled

    6 details in Everything