About
=====

Plown is a security scanner for Plone CMS. Although Plone has the best security track record of any major CMS and is considered highly secure, misconfigurations and weak passwords might enable system break-ins. Plown has been developed to ease the discovery of usernames and passwords, and act as an assistant to system administrators to strengthen their Plone sites.


Installation
============
Plown is written on Python and does not need installation. Just clone the github repository and run. 

user@user:~/Desktop$ git clone https://github.com/unweb/plown
user@user:~/Desktop$ cd plown
user@user:~/Desktop/plown$ ./plown.py


What can Plown do
=================
Plown has two modes: enumeration mode and brute force mode. On enumeration mode it tries to find usernames and find out if several known vulnerabilities exist. 
On brute force mode, Plown will try to authenticate to a Plone site using a list of users and passwords specified, by connecting with multiple threads. By default 16 threads are started, with that number being configurable. 
Plone version enumeration is scheduled for the next release of Plown.


Help
====
Just run the program without any arguments to get some help
user@user:~/Desktop/plown$ ./plown.py

More
====
Learn about Plone security and how Plone addressess common security issues: http://plone.org/products/plone/security/overview

To do
=====
Plone version enumeration, based on md5 hashes of static stuff (js, css).
Better username enumeration (crawl the site and look the Creator of each page).
More vulnerabilities to be added. 

Author
======
Plown was created by provetza of https://unweb.me. provetza at unweb dot me

Tested on
=========
Python2.4, 2.6, 2.7

Credits
=======
All credits go to Plone creators for this awesome CMS.