{"id":3318,"date":"2017-08-16T15:50:38","date_gmt":"2017-08-16T13:50:38","guid":{"rendered":"http:\/\/securite.intrinsec.com\/?p=3318"},"modified":"2017-08-16T15:50:38","modified_gmt":"2017-08-16T13:50:38","slug":"comission-whitebox-cms-analysis","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/comission-whitebox-cms-analysis\/","title":{"rendered":"CoMisSion \u2013 Whitebox CMS analysis"},"content":{"rendered":"<h1>Context<\/h1>\n<p>At Intrinsec, source code auditing is one of our missions. Among different languages and technologies, CMS analysis is common.<\/p>\n<p>When auditing a CMS, we have to answer the following questions:<\/p>\n<ul>\n<li>Which version of the CMS core is used?<\/li>\n<li>Are there any vulnerabilities affecting this version?<\/li>\n<li>Has the core been altered?<\/li>\n<li>Which plugins are used? In which version?<\/li>\n<li>Are there any vulnerabilities affecting these plugins?<\/li>\n<li>Have the plugins been altered?<\/li>\n<\/ul>\n<p>Much of this information can be gathered easily from a CMS folder (WordPress and Drupal, at least). But it can be long, tedious, error-prone and you should probably never spend time doing what a well-trained monkey can do.<\/p>\n<h1>Commission<\/h1>\n<p>CoMisSion is a tool to automate all this stuff. You give it a CMS type (WordPress and Drupal are currently supported), a source code directory, an output filename and you are ready to go.<\/p>\n<p>Code, setup process, usage, and other details are available on <a href=\"https:\/\/github.com\/Intrinsec\/comission\">Github<\/a>.<\/p>\n<p>The tool prints its results to stdout. You can see here an example of a WordPress core analysis. To gather CVEs, the tool uses the WPvulndb API.<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"size-full wp-image-3323 aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2017\/08\/2017-08-14_10-06-06.stdout1.png\" alt=\"\" width=\"712\" height=\"339\" \/>Once the version is identified, the tool downloads a \u00abclean\u00bb archive of this version and checks for any alteration. This way, we can quickly focus on the homemade development done by our client.<img decoding=\"async\" class=\"size-full wp-image-3327 aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2017\/08\/2017-08-14_10-24-30.stdout3.png\" alt=\"\" width=\"719\" height=\"114\" \/><\/p>\n<p>Then the tool analyzes each plugin the same way.<img decoding=\"async\" class=\"size-full wp-image-3324 aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2017\/08\/2017-08-14_10-06-38.stdout2.png\" alt=\"\" width=\"1017\" height=\"371\" \/><\/p>\n<p>Up-to-date and unmodified plugins are thus eliminated from the manual analysis.<\/p>\n<p>The tool can do this type of analysis only if the plugin is published on the official CMS website and follows its guidelines. However, if the plugin is not free or has been downloaded from another website, you have to find out its location and manually perform the analysis.<\/p>\n<h1>Report<\/h1>\n<p>The tool generates a report as an XLSX file, with four tabs:<\/p>\n<ul>\n<li>The core<\/li>\n<li>Alterations to the core<\/li>\n<li>The plugins list and analyses<\/li>\n<li>Alterations to plugins<\/li>\n<\/ul>\n<p>In the report, the tool consolidates the gathered information.<\/p>\n<p>Below you can see an example of the first tab. Using wpvulndb, the tool gathers some details on CVEs such as the type (XSS, RCE, etc.) or in which version the vulnerability is fixed.<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-3320 aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2017\/08\/2017-08-14_09-23-24.png\" alt=\"\" width=\"1200\" height=\"243\" \/><\/p>\n<p>And below is the plugins analysis tab.<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-3319 aligncenter\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2017\/08\/2017-08-14_09-22-47.png\" alt=\"\" width=\"1200\" height=\"319\" \/><\/p>\n<p>This report is a starting point of our audit. We can then go further and perform in-depth analysis of the alterations made to the core and the plugins.<\/p>\n<p>Feel free to try it and report any issue on <a href=\"https:\/\/github.com\/Intrinsec\/comission\">Github<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Context At Intrinsec, source code auditing is one of our missions. Among different languages and [&hellip;]<\/p>\n","protected":false},"author":24,"featured_media":3319,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-non-categorise"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>CoMisSion - Whitebox CMS analysis - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/comission-whitebox-cms-analysis\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CoMisSion - Whitebox CMS analysis\" \/>\n<meta property=\"og:description\" content=\"Context At Intrinsec, source code auditing is one of our missions. Among different languages and [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/comission-whitebox-cms-analysis\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2017-08-16T13:50:38+00:00\" \/>\n<meta name=\"author\" content=\"Paul MARS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Paul MARS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/\"},\"author\":{\"name\":\"Paul MARS\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/e4ee00c11b3f40b585484be28db4d3b1\"},\"headline\":\"CoMisSion &#8211; Whitebox CMS analysis\",\"datePublished\":\"2017-08-16T13:50:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/\"},\"wordCount\":404,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"Non cat\u00e9goris\u00e9\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/\",\"name\":\"CoMisSion - Whitebox CMS analysis - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2017-08-16T13:50:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/comission-whitebox-cms-analysis\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CoMisSion &#8211; Whitebox CMS analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/e4ee00c11b3f40b585484be28db4d3b1\",\"name\":\"Paul MARS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Paul MARS\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/paul-mars\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CoMisSion - Whitebox CMS analysis - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/comission-whitebox-cms-analysis\/","og_locale":"en_US","og_type":"article","og_title":"CoMisSion - Whitebox CMS analysis","og_description":"Context At Intrinsec, source code auditing is one of our missions. Among different languages and [&hellip;]","og_url":"https:\/\/www.intrinsec.com\/en\/comission-whitebox-cms-analysis\/","og_site_name":"INTRINSEC","article_published_time":"2017-08-16T13:50:38+00:00","author":"Paul MARS","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Paul MARS","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/"},"author":{"name":"Paul MARS","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/e4ee00c11b3f40b585484be28db4d3b1"},"headline":"CoMisSion &#8211; Whitebox CMS analysis","datePublished":"2017-08-16T13:50:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/"},"wordCount":404,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#primaryimage"},"thumbnailUrl":"","articleSection":["Non cat\u00e9goris\u00e9"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/","url":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/","name":"CoMisSion - Whitebox CMS analysis - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#primaryimage"},"thumbnailUrl":"","datePublished":"2017-08-16T13:50:38+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"CoMisSion &#8211; Whitebox CMS analysis"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/e4ee00c11b3f40b585484be28db4d3b1","name":"Paul Mars","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Paul MARS"},"url":"https:\/\/www.intrinsec.com\/en\/author\/paul-mars\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/3318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=3318"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/3318\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=3318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=3318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=3318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}