Security scanner for Plone CMS

Plown is a security scanner for Plone CMS. Although Plone has the best security track record of any major CMS and is considered highly secure, misconfigurations and weak passwords might enable system break-ins.
Plown has been developed to ease the discovery of usernames and passwords, and act as an assistant to system administrators to strengthen their Plone sites.

Installation

Plown is written on Python and does not need installation. Just clone the github repository and run.

user@user:~/Desktop$ git clone https://github.com/unweb/plown
user@user:~/Desktop$ cd plown
user@user:~/Desktop/plown$ ./plown.py

What can Plown do

Plown has two modes: enumeration mode and brute force mode. On enumeration mode it tries to find usernames and find out if several known vulnerabilities exist.
On brute force mode, Plown will try to authenticate to a Plone site using a list of users and passwords specified, by connecting with multiple threads. By default 16 threads are started, with that number being configurable.
Plone version enumeration is scheduled for the next release of Plown.

Download

Latest zipball