joomla-security-scanner - Joomla security scanner for detecting malware, web

项目说明

🛡️ MuRu Guard Security Scanner (Joomla Extension)

!Downloads

<a href="
<img width="100%" alt="MuRu Guard Pro is now a for Joomla 3 — log in or register at the store to get it" src=" />
</a>

🆕 New: a dedicated Joomla 3 edition of MuRu Guard Pro — the same scanning engine plus a real-time shield that blocks disclosed unauthenticated SQLi/RCE/path-tra exploits in un-updatable SP Page Builder, Helix, EasyStore, and SP Property Finder . Log in or register at the store to get it →

Download: grab the latest installable zip from the dist/ folder in this repo — built the same way a tagged release normally would, just published here directly. com_muruguard-X.Y.Z.zip is the scanner component; plg_muruguardshield-X.Y.Z.zip is its optional companion real-time protection plugin.

---

⭐ Want more? MuRu Guard Pro

📋 Pro Changelog & Road Map → — what shipped in each Pro release and what's coming next.

E on this page is free and always will be — full scanning, cleanup, and Protection Mode, no restrictions. MuRu Guard Pro adds a paid layer on top, for site owners who want more:

| | |
|---|---|
| 🧬 File Integrity Monitoring | Catches what signature scanning can't: a backdoor hand-inserted into a file you already trust. Baseline every file once, then get alerted the instant any of them silently changes |
| 🧱 Active Web Application Firewall | Blocks generic SQL injection, XSS, local/remote file inclusion, and command-injection patterns in incoming requests -- broader than Protection Mode's webshell-specific checks, which stay on regardless and are checked first |
| 🤖 Smart AI Assistant | A chat-based assistant, right inside the admin panel, that reads/searches/fixes your Joomla project's code on request -- bring your own Claude, GPT, Gemini, OpenRouter, or custom-endpoint key |
| ⏪ Backup & Restore (TimeMachine) | Every AI-driven or bulk repair action is automatically snapshotted first -- pin a snapshot to keep it forever, or roll any single change back with one click if a fix wasn't what you expected |
| 🛫 Autopilot Mode | A scheduled scan's near-zero-false-positi get an independent AI check before anything is touched; only a confirmed leads to a (still fully restorable) removal -- no human needed to review the obvious cases |
| 🚩 Fleet Dashboard | Monitor every licensed site's scan status from one place |
| 📡 Fleet bulk actions | Trigger a remote re-scan or push a hardening config change across every licensed site from the Fleet Dashboard, instead of logging into each site's admin indi |
| 🔔 Instant Alerts | Slack/Discord/ck -- finds something new |
| 📄 Branded Security Reports | One-click, print-ready reports to share with clients or stakeholders |
| 🔒 MuRu Shield Hardening | A self-testing, auto-rollback ser password gate in front of /administrator — blocks brute-force attempts before Joomla e |
| 💬 Priority support | A tracked support ticket, not just a public issue queue |

🎁 New: already on Pro? Share MuRu Guard Pro in a Joomla community or leave a review, submit the link from My Products in your dashboard, and get 15 free days added to your license per link -- submit as many as you like.

Create a free account and get MuRu Guard Pro →

---

A Joomla extension that detects and helps remo left behind by the SP Page Builder uploadCustomIcon unauthenticated RCE ( prior to 6.6.2). It also checks the JCE editor component (com_jce), which has been reported as a secondary infection on sites compromised through SPPB.

Installs like any other Joomla extension. Runs inside the Joomla administrator, behind Joomla's own authentication and ACL — no separate access key, no public-facing scanner file, nothing to remember to delete afterward.

Requirements: Joomla 4 or 5. This free edition is built entirely on Joomla's namespaced Joomla\CMS\* API, which Joomla 3 doesn't have — Joomla 3 sites are covered by the separate MuRu Guard Pro (Joomla 3 edition) linked abo.

Privacy: scanning and cleanup run entirely on your own ser your own files — no results, file paths, or matched code are ever sent anywhere. The only outbound calls this free edition e are Joomla's own standard "Check for Updates" mechanism (so you're notified of new , exactly like any other extension) and, if you explicitly submit the optional newsletter form in the admin panel, that one submission. Nothing else, ever, without you initiating it.

Need Help? <a href=" Me</a> or Email me at <a href="mailto:"></a>

---

⚠️ Critical security notice

In June 2026, a critical unauthenticated RCE was disclosed in SP Page Builder below 6.6.2. The flaw allowed attackers to upload PHP webshells without any login, read configuration.php, create rogue Super User accounts, and inject Stored XSS payloads into Helix Ultimate mega-menu items — often within minutes of finding a site.

Before doing anything else:

1. Update SP Page Builder to 6.8.0 or later. Scanning a site that's still just means cleaning up the same infection again tomorrow.
2. Update or remove JCE if installed. Several hosts ha malware appearing inside com_jce on sites also hit by the SPPB exploit — most likely the same attacker reusing JCE's file-browser upload path as a fallback once they had a foothold.
3. Take a full backup and, if possible, run your first scan on a staging copy of the site rather than production.

---

✨ What it does

| Category | Detail |
|---|---|
| ⏱️ Chunked, resumable scanning (new) | A scan no longer runs inside one blocking request. It's broken into small pieces (one directory area, the database check, etc. at a time), each bounded to a fixed time budget, with a real progress bar in the browser -- so a large site's scan can never come back as a bare "500 - Whoops" from hitting a host's execution-time limit, regardless of site size |
| 🛡️ Protection Mode | A companion plugin checks every request to the site in real time — not just when you open the scanner — for webshell interaction, the SPPB uploadCustomIcon RCE, known malware-drop filenames, path-tra probes, and brute-force login attempts, with independent opt-in switches to actually block high-confidence matches and brute-force IPs. E detected shows up in a sectioned Protection Log (IP, time, rule, se, blocked/logged-only), and every toggle here is disabled until the companion Shield plugin is actually installed and enabled, so a setting can never look acti doing nothing. See 🛡️ Protection Mode below |
| 🔐 Admin Lockdown, Protected Users & Test a Request (new) | Blocks the extension installer and new-backend-user creation while on; snapshots every Super User and auto-reverts a blocked/demoted account (email/password changes and deletions are alerted, ne re); and a read-only "Test a Request" tool previews what Shield would do with a given URL/IP/User-Agent before you flip any blocking switch on. See 🔐 Admin Lockdown, Protected Users & Test a Request below |
| 🗂 Filesystem scan | Walks media/, images/, templates/, tmp/, cache/, the SPPB and JCE component directories, core Joomla entry points, and the webroot itself |
| 🧬 Content signatures | Flags known webshell patterns (e(...)), assert($_POST...), gsocket, generic shells like c99/r57/WSO), stream-wrapper payload loading (zip://, phar://, compress.zlib://), chr()-from-byte-array decoding, string-lookup obfuscation, self-replicating dropper logic, and <head>-tag script injection |
| 🚪 Core entry-point integrity | Checks index.php, administrator/index.php, api/index.php, and includes/app.php for any code executing *before* Joomla's _JEXEC bootstrap — the exact pattern used by real-world "prepended payload" infections |
| 📛 Filename patterns | Matches known malicious naming con from real SPPB compromises (e.g. codex-sppb-*.php), plus backup/duplicate configuration.php files (configuration.bak.php, etc.) that leak the same credentials as the li |
| 🔢 Numeric drop folders | Flags randomly-named numeric folders in templates/, media/, or images/ — a common automated-drop pattern — while correctly ignoring legitimate date-based upload folders (images/2026/06/17/) |
| 🎭 Fake index.php detection | Joomla's standard index.php stub is a one-line "no direct access" guard; anything beyond that is flagged as a likely disguised webshell |
| 🌐 Webroot hygiene | Any unrecognized top-le or loose file sitting directly next to configuration.php is flagged — with a built-in exclusion for Google Search Console site- files (google*.html) |
| 🎯 Confidence scoring | Every finding is labeled High or Medium so you can triage quickly instead of guessing |
| 🧩 JCE co | Same heuristics applied to media/com_jce, administrator/components/com_jce, components/com_jce, and plugins/editors/jce, with allow-lists tuned to avoid flagging JCE's own legitimate core/M |
| 👤 Rogue Super Users | Flags accounts with attacker-pattern usernames (webmanager83, codex*) or .local email domains |
| 🗄 Database scan | Checks #__menu for Helix Ultimate mega-menu XSS injections (broad signature set, not just one known payload string), #__sppagebuilder_assets for injected eval/base64_decode content and rogue iconfont registrations, and #__template_styles for defacement messages |
| 🧹 Guided cleanup | Built-in delete action for files/folders (scoped only to items flagged in the current scan run), a surgical params cleaner for injected menu items (see below), and a delete action for rogue asset rows |

---

📦 Installation

This ships as two standard Joomla extension packages — no manual file uploads, no key generation, no separate URL to protect:

1. Download the packages

> ⚠️ Releases are currently down (see the notice at the top of this page) — grab both com_muruguard-X.X.X.zip and plg_muruguardshield-X.X.X.zip from the dist/ folder in this repo instead of the Releases page, until that's fixed.

2. Install via the Joomla administrator

1. Log into your Joomla administrator as a Super User.
2. Go to System → Import → Extensions (or System → Manage → Install on Joomla from 4.x.x to latest).
3. Upload com_muruguard-X.X.X.zip first, then plg_muruguardshield-X.X.X.zip (or point Joomla at either one via Install from Folder / URL).
4. Once installed, the scanner appears under Components → MuRu Guard in the admin sidebar.
5. If you installed the plugin, enable it under System → Manage → Plugins, search "MuRu Guard Shield", and toggle it on. It does nothing until enabled here *and* until Protection Mode is turned on from the scanner's own Settings panel — see below.

3. Set permissions (optional but recommended)

By default, only Super Users can access the component. If you want to delegate scanning to a trusted admin without granting full Super User rights, go to System → Users → Access Levels / Permissions and grant the com_muruguard Manage, Clean, Delete, or Change Settings permission to the relevant user group.

4. Run a scan

Open Components → MuRu Guard → Scan. Click 🔍 Run a Scan — this opens a modal where you pick which directories and checks to include (or just lea selected), then click Run inside it. Results are shown grouped by confidence level, with checkboxes for the items you want to act on.

No API keys, no separate login screen, no public URL to lock down afterward — access control is entirely handled by Joomla's existing user/session/ACL system, and the component is only reachable by an authenticated admin session with the right permission, the same as any other Joomla component.

---

🧪 Detection details

Filesystem

Users

Database

---

🧹 Cleanup workflow

If the scan finds something:

1. Don't panic-delete. Review High-confidence findings first, then Medium. If unsure, copy a file elsewhere before removing it.
2. A core entry-point finding is the top priority. It means every page load is currently executing attacker code — treat the site as actively compromised right now, not just historically infected.
3. Delete confirmed file/folder malware using the checkboxes and the Delete button — only files flagged by the current scan run can be removed, and top-le folders are hard-protected regardless of what gets flagged.
- Before cleaning, click 🧬 Code Issues on any row in the Cleanable Files tab — if the scanner recognizes an auto-fixable pattern in that file's *current* on-disk content, the same modal shows a 🔍 Preview section with the exact bytes Clean would remove (and what, if anything, replaces them), so you can the fix before running it.
4. Clean (not delete) injected menu items. The Menu XSS section has its own "Clean selected" action. This surgically strips only the known injection markers (<script> tags, e attributes, localStorage calls, MutationObserver, marker domains) out of the params JSON, field by field, and lea legitimate Helix Ultimate/SPPB layout setting on that menu item untouched. It also enforces that item_id is always a plain integer — if a payload replaced it with markup, that field is blanked rather than left as garbage, since there's nothing safe to salvage there. If a row's params can't be safely parsed as JSON at all, it's skipped with a note so you can review it by hand instead of risking corruption.
5. Delete rogue iconfont/asset rows using the checkboxes in the SP Page Builder asset table section.
6. Remo Super Users manually Admin → Users → Manage.
7. Clean template styles defacement directly /SQL (this section is report-only, since defacement text sits alongside legitimate template settings that vary too much to auto-clean safely).
8. Rotate every credential readable from configuration.php (and any backup copies found): database password, SMTP password, API keys, and Joomla's secret value.
9. Force-logout all sessions by truncating #__session or using Users → Sessions → Destroy.
10. Check cron jobs (crontab -l via SSH, or your hosting panel) for anything you didn't add.
11. Re-scan after cleanup, and again in a few days — some droppers re-create themselves via a lefto task or a second, undiscovered backdoor.

---

🛡️ Protection Mode (real-time attack blocking)

On-demand scanning finds an infection *after* it's already happened. Protection Mode, via the companion plg_muruguardshield plugin, checks every single request to your site as it happens — the only extension type Joomla runs on every page load, before routing e.

1. Install and enable plg_muruguardshield (see Installation above) — it does nothing on its own, it's entirely controlled from the scanner's own Settings panel.
2. In Components → MuRu Guard → ⚙️ Settings → 🛡️ Protection (this is the default tab), turn on:
- Protection Mode — the master switch. Detects and logs every match. Safe to leave on by itself: zero risk of blocking a real .
- Actively block high-confidence attack patterns *(opt-in)* — rejects webshell interaction, a direct probe against the SPPB uploadCustomIcon RCE, and known malware-drop filenames with a 403, instead of only logging them. Lower-confidence matches (path-tra probes, known scanner User-Agents) are always logged only, ne, since those are broad enough to occasionally match legitimate traffic.
- Block brute-force login attempts *(opt-in)* — rejects further backend login attempts from an IP once it crosses a threshold (default 5 failures in 15 minutes, both configurable).
3. E detected — blocked or not — appears in the Protection Log right below those switches, sectioned into Attack Pattern Matches and Brute-Force Login Attempts, each row showing IP, timestamp, se, matched rule, and whether it was actually blocked.

All three switches are off by default. Already-authenticated, non-guest admin sessions are exempt from request-pattern blocking, so a legitimate action can never trip a false block and lock you out of your own site — brute-force blocking has no such exemption, since it only e pre-authentication login attempts.

> ⚠️ If your site sits behind a reverse proxy or CDN that doesn't forward the real client IP, every can appear as one IP to this plugin — check that your setup forwards REMOTE_ADDR correctly before relying on brute-force blocking in production.

---

🔐 Admin Lockdown, Protected Users & Test a Request

Three newer additions under Components → MuRu Guard → ⚙️ Settings → 🛡️ Protection, all off by default:

---

⏰ Scheduled scanning (webcron alerts)

Point any cron system at a webcron URL and get an email only when something new shows up — not on every run, and never on the very first run (which just records a baseline).

1. Click ⚙️ Settings in the top-right corner of the scanner page (next to Support). Flip the scheduled scanning switch on, click 🎲 Generate to fill in a secret token, set an Alert email address, then 💾 Sa. (The same 3 fields also li System → Global Configuration → MuRu Guard, if you prefer that route — both stay in sync.)
2. Copy the webcron URL shown right there in the Settings panel (there's a 📋 button), or build it yourself:

3. Add a job to your server's crontab, your host's "Cron Jobs" control panel, or a free external cron service (e.g. cron-job.org) that fetches that URL once a day. A plain curl or wget works — no login, no CSRF token, no SSH access to the ser. A crontab entry looks like:

4. The switch is the master control — turning it off stops scheduled scanning immediately without losing your token/email, and an empty token is ne even when the switch is on. Off by default.

This reuses the same detection logic as a manual scan (including the core-checksum above), it just tracks what's new between runs and only emails when the new-findings count is greater than zero.

---

🔐 Hardening

The most effecti fix is blocking PHP execution in directories that should only ever hold static assets. Add this to your site's .htaccess:

Even if a webshell makes it onto the server, this returns a 403 instead of executing it.

Other recommendations:

---

🗑️ Uninstalling

Since these are standard Joomla extensions, removal is a normal uninstall — no separate cleanup step needed:

System → Manage → Extensions, filter by "MuRu Guard", select the component (and the plg_muruguardshield plugin, if installed), and click Uninstall. This removes each extension's files and database records in one action. Uninstalling the plugin alone (keeping the component) simply turns off real-time protection while leaving on-demand scanning intact.

---

📋 Recommended order of operations

1. Back up the full site
2. Update SP Page Builder to 6.8.0+
3. Update or remove JCE if installed
4. Install the extension via the Joomla administrator
5. Run the scan, review findings carefully — start with core entry-point findings if any exist
6. Clean injected menu items, delete confirmed malware files, and remo asset rows
7. Remo Super Users and clean template defacement
8. Rotate all credentials
9. Apply the .htaccess hardening rule
10. Uninstall the extension once you're confident the site is clean (optional — it's safe to lea for future re-scans)

---

🔒 Security model

---

❤️ Support this project

If this tool saved you time, consider supporting continued de:

☕ Buy me a coffee ( or PayPal Zoom)

And if you found it useful, a ⭐ on the repository helps others find it too.

---

📝 Feedback

If you have any feedback or suggestions, please open an issue on the repository.

Got a feature you'd like to see next? More detection co, deeper auto-cleanup, better reporting, something else entirely — open an issue and let me know what would actually be useful to you.

---

🙏 Thanks to

MD. Toufiqur Rahman, Paul Frankowski, Ofi Khan, and Md. Atick Eashrak Shuvo, for your support and contributions in helping me to improve this tool.

🐛 Thanks to our issue reporters

Every bug report, false-positive flag, and suggestion filed on the issue tracker directly shapes what gets fixed next. Thanks especially to:

· · · · · -Code · ·

— for taking the time to report issues, test fixes, and help push this tool to actually be better. If you' an issue and don't see your name here yet, it'll get added — let me know.

👨‍💻 Author

ZKRANA

---

📄 License

GNU General Public License 2 or later — see LICENSE.txt.

项目信息

开发语言：PHP

Star 数：15

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Joomla security scanner for detecting malware, webshells, rogue admins, and exploit artifacts from SP Page Builder and JCE vulnerabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。