I am doing a security audit for a client. Their installation is Drupal 6.22. I need to show them it's unsafe. What is the easiest way to hack it as an example?

I would need to directly show them the steps, so it must be quite detailed instructions. They have the following modules installed:

  1. Administration menu
  2. Color
  3. Comment
  4. Database logging
  5. Help
  6. PHP filter
  7. Taxonomy
  8. Update status
  9. Masquerade
  10. CKEditor
  11. AES

Here are some common settings:

  1. Server Apache/2.2.3
  2. MySQL database 5.0.77
  3. PHP 5.2.17
  4. update.php Protected
  5. File system Writable
  6. register_globals Disabled

2 Answers 2


The question you're asking is pretty impossible to answer. If you know Drupal and/or web security then you'll know the answer already. If you don't then the answer is too long to put into a Stack Exchange comment.

Here are some articles about how I have gained knowledge of web application security and how I perform a security audit of a Drupal site:

I agree with Ivan Alfaro that the security_review module is a good start. Many of the elements that the security_review module audits can be audited from outside a site, so you could look at what it does and see if you can do similar things.

  • I went through the few modules recommended in your link and they were not able to identify any problems. I am going to start reading Cracking Drupal soon...
    – Yongke Bill Yu
    Mar 3, 2012 at 23:10

Easiest way to identify potential vulnerabilities is to install the Security review module.

  • This is definitely an easy solution, but not a complete one. Thanks for recommending it!
    – greggles
    Feb 9, 2012 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.