owasp/vbscan

OWASP VBScan is a Black Box vBulletin Vulnerability Scanner

OWASP VBScan

OWASP VBScan (short for [VB]ulletin Vulnerability [Scan]ner) is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analysis them .

Why OWASP VBScan ?

If you want to do a penetration test on a vBulletin Forum, OWASP VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest VBulletin vulnerabilities.

• Project Leader : [Mohammad Reza Espargham] (reza[dot]espargham[at]owasp[dot]org)
• Github : https://github.com/rezasp/vbscan/
• SourceForge : https://sourceforge.net/projects/vbscan/
• OWASP Page : https://www.owasp.org/index.php/OWASP_VBScan_Project

usage :

./vbscan.pl <target>
./vbscan.pl http://target.com/vbulletin

OWASP VBScan 0.1.7 introduction (Youtube)

OWASP VBScan Teaser (Youtube)

vbscan's Issues

Adaptation

Hello man. You can adapt it to the latest version perl?

VBScan 0.1.1 released

vbscan does not show any information

cmd = perl vbscan.pl url.com
no output, just says your reports: reports//
going to the report files created shows a blank txt file and blank html
Perl version: 5.30.1
uname -an = Darwin root.local 19.4.0 Darwin Kernel Version 19.4.0: Wed Mar 4 22:28:40 PST 2020; root:xnu-6153.101.6~15/RELEASE_X86_64 x86_64

VbScan Not work

Hello
Vbscan Not Work
cmd = perl vbscan.pl google.com

perl -v = v5.22.3
uname -an = Linux 3v1l 4.9.9-100.fc24.x86_64 #1 SMP Fri Feb 10 00:24:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Module Pathdisclure broken?

Hello, there appears to be an issue with the pathdisclure module, here's the console output:

[user@domain]$ perl pathdisclur.pl
Can't call method "get" on an undefined value at pathdisclure.pl line 5.

And the output if I try to run via bash:

[user@domain]$ ./pathdisclur.pl
./pathdisclure.pl: line 3: syntax error near unexpected token `('
./pathdisclure.pl: line 3: `@plinks = ("forumdisplay.php?do[]=[test.dll]","calendar.php?do[]=[test.dll]","search.php?do[]=[test.dll]","forumrunner/include/album.php","core/vb5/route/channel.php","core/vb5/route/conversation.php","includes/api/interface/noncollapsed.php","includes/api/interface/collapsed.php","vbseo_sitemap/addons/vbseo_sm_vba.php","vbseo_sitemap/addons/vbseo_sm_vba_links.php");'

I'm on the newest version of Kali Linux, scanning one of my vbulletin sites.

vbscan doesn't start on kali linux rooling

i cloned the project to kali using
git clone
then went to the directory passed this command
perl vbscan.pl
and nothing happens
:( what should i do help ?

Pls add check validator.php

Hi,
I have small idea, pls add check for validator.php file. With this file you can see all files and directories from the folder with vBulletin installed...

Soon ;)

Needs proper output flag instead of redirection

See title. Color information is messing up output redirected 'log files'.

Nice work! Very interesting script. I hope you'll keep this up to date.

Unable to run on ubuntu

After running on ubuntu perl vbscan.pl (link|path)

String found where operator expected at modules/cpfinder.pl line 8, near "fprint "admincp does not exist or renamed""
(Do you need to predeclare fprint?)

Undefined subroutine &main::tprint called at vbscan.pl line 76.
perl v5.14.2

Running the Script on Windows

After Running the code on windows

cmd> perl vbscan.pl

it returns :-
Undefined subroutine &main::tprint called at "PATH"\vbscan.pl line 76

Restore Color

dont forget to use "\x1b[0m" to restore the original terminal color, else the text will stay blue even after vbscan exits .

`The target is alive! But is not running on vbulletin` for all tested sites

The target is alive! But is not running on vbulletin. - the same message for first 10 sites from https://www.google.com/search?q=powered+by+vbulletin
Is that normal?