rcube-scan

Roundcube Webmail enumeration and vulnerability scanner. Like wpscan, but for Roundcube.

Installation

uv tool install git+https://github.com/evait-security/rcube-scan

Or from a local checkout:

git clone https://github.com/evait-security/rcube-scan
cd rcube-scan
uv pip install -e .

Usage

Full scan (fingerprint + enumeration + vulnerability check):

rcube-scan --url https://mail.example.com

Self-signed or invalid certificates:

rcube-scan --url https://mail.example.com --no-verify

JSON output:

rcube-scan --url https://mail.example.com --json -o results.json

Subcommands

Fingerprint only (version, skin, plugins, server):

rcube-scan --url https://mail.example.com --fingerprint-only

Directory and file enumeration:

rcube-scan --url https://mail.example.com --enumerate-only

Bruteforce login:

rcube-scan --url https://mail.example.com --bruteforce -U admin -w passwords.txt

Fetch an exposed file:

rcube-scan read --url https://mail.example.com CHANGELOG.md

List all known CVEs:

rcube-scan cves --min-cvss 7.0
rcube-scan cves --exploit-only

Options

-u, --url           Target URL
-f, --fingerprint   Fingerprint only (skip enumeration)
-e, --enumerate     Enumerate only (skip fingerprint)
--no-vulns          Skip CVE check
-b, --bruteforce    Enable brute-force
-U, --username      Single username
--userlist          File with usernames (one per line)
-P, --password      Single password
-w, --passlist      Password wordlist
-p, --proxy         Proxy URL (e.g. http://127.0.0.1:8080)
-t, --timeout       Request timeout in seconds (default: 30)
-c, --concurrency   Concurrent requests (default: 15)
--no-verify         Disable TLS verification
--json              Output as JSON
-o, --output        Write JSON to file

What it detects

• Roundcube version (via rcversion in page JavaScript)
• Active skin and all available skins
• Installed plugins (both from HTML and by probing plugin paths)
• Exposed files (CHANGELOG.md, composer.json, .git/HEAD, installer etc.)
• Directory access (config/, logs/, temp/, vendor/, bin/, SQL/ etc.)
• Server header, branding, locale, session lifetime
• CSRF protection, OAuth/OIDC endpoints, 2FA status
• Known CVEs matching the detected version

Requirements

• Python 3.10+
• uv
• Network access to target

License

MIT