Mass Hunting XSS — Moodle

Hello friends! In this article, We are going to see How to Identify, Mass hunt and Exploit Moodle.

Moodle is a free and open-source learning management system (LMS) written in PHP and distributed under the GNU General Public License. Developed on pedagogical principles, Moodle is used for blended learning, distance education, flipped classroom and other e-learning projects in schools, universities, workplaces and other sectors.

  • Wappalyzer
  • Favicon Icon
  • Subdomain (moodle.target.com)
Example

Here you can see this target is perfect example. We can see Moodle’s Favicon, Wappalyzer and subdomain of target.com

  • Search query: http.component:Moodle
  • Favicon Base: http.favicon.hash:-438482901

Shodan CLI:

  • shodan search “http.component:Moodle” — fields ip_str,port — separator “ “ | awk ‘{print $1”:”$2}’ | tee -a moodlehunt.txt
  • shodan search “http.favicon.hash:-438482901” — fields ip_str,port — separator “ “ | awk ‘{print $1”:”$2}’ | tee -a moodlehunt.txt

Google Dork:

  • inurl:”/login/index.php”

⚠ This is educational purpose only. I am not responsible if you misuse or damage any organizations with this vulnerability. Because this LMS mostly used by universities and schools. ⚠

Instagram: th3.d1p4k

Twitter: Dipak Panchal

Bug hunter | CCSE