content management systems and blogging platforms such as joomlawordpressand drupal make starting new blog or website simpleand they're relatively common in shared hosting environment or even an enterprise network all systems have their own challenges in terms of installationconfigurationand patch managementand these cms suites are no exception when an overworked sysadmin or hapless web developer doesn' follow all security and installation proceduresit can be easy pickings for an attacker to gain access to the web server because we can download any open source web application and locally determine its file and directory structurewe can create purpose-built scanner that can hunt for all files that are reachable on the remote target this can root out leftover installation filesdirectories that should be protected by htaccess filesand other goodies that can assist an attacker in getting toehold on the web server this project also introduces you to using python queue objectswhich allow us to build largethread-safe stack of items and have multiple threads pick items for processing this will allow our scanner to run very rapidly let' open web_app_mapper py and enter the following codeimport queue import threading import os import urllib threads target "directory "/users/justin/downloads/joomla-filters [jpg",gif","png",css"os chdir(directoryweb_paths queue queue(for , , in os walk(")for files in fremote_path "% /% ( ,filesif remote_path startswith(")remote_path remote_path[ :if os path splitext(files)[ not in filtersweb_paths put(remote_pathdef test_remote()while not web_paths empty()path web_paths get(url "% % (targetpathrequest urllib request(urltryresponse urllib urlopen(requestcontent response read(print "[% =% (response code,pathresponse close(except urllib httperror as error#print "failed %serror code pass for in range(threads)print "spawning thread%di threading thread(target=test_remotet start(