Admin Panel Finder

#admin-panel-finder #login-finder #wordpress-admin-finder #cpanel-finder #plesk-finder #phpmyadmin #cms-login-scanner #bug-bounty #pentest-tools #recon #osint #web-security #authorized-scanning

Admin Panel Finder is a free admin panel finder, login page finder, WordPress admin finder, cPanel finder, Plesk finder, phpMyAdmin finder, and CMS login scanner for authorized bug-bounty and pentest recon.

It looks for admin panels, login pages, wp-admin, wp-login.php, Joomla administrator, Drupal login, Webmin, Grafana, Jenkins, and GitLab on hosts that are in scope. Discovery is DNS + GET/HEAD only.

Owner: rootbytex
Repository: github.com/rootbytex/admin-panel-finder
License: MIT · Version: 2.3.2

Runs on Windows, Linux, macOS, and Termux (Python 3.10+). The TUI is ASCII-safe so Windows cmd.exe stays readable.

---

Table of contents

• What this tool is
• What this tool is not
• Authorized use
• Features
• Install
• Usage
• Command-line flags
• Wordlists
• Reports
• GitHub About and topics
• Contributing
• Security
• License

---

What this tool is

A recon helper that answers: does this in-scope host expose an admin or login surface?

Typical matches:

Kind	Examples
CMS admin	WordPress wp-admin, Joomla administrator, Drupal, Magento, PrestaShop, Ghost, Typo3, Umbraco
Hosting panels	cPanel, Plesk, DirectAdmin, Webmin, CyberPanel, Hestia, aaPanel
App panels	phpMyAdmin, Grafana, Jenkins, GitLab, Portainer, Cockpit
Framework admin	Laravel, CodeIgniter, Django, Flask login/admin prefixes

Findings include evidence (title, login form, favicon hash, CMS headers) and a confidence score — not a raw status-code dump.

What this tool is not

This is not an exploit framework.

It does not:

• brute-force passwords or spray credentials
• bypass 403 / WAF / authentication
• send payloads, shells, or exploit PoCs
• scan hosts that fall out of scope

Out-of-scope names are logged and never probed. Optional search-engine hits are candidates only and still must pass scope.

Authorized use

Run it only against systems you own or that a written engagement puts in scope.

Misuse against third-party systems is your responsibility. See SECURITY.md.

---

Features

• Scope engine — apex / patterns from a scope file; everything else is skipped
• DNS discovery — subdomain labels, wildcard detection, public DNS fallback (Termux-friendly)
• Panel paths — generic list plus unique CMS / framework / hosting-panel lists (no copy-paste /admin everywhere)
• Framework-aware paths — if /admin is 404, still try /index.php/admin when CodeIgniter is detected
• Login-form + favicon fingerprints — evidence in the JSON, not guesses from 200 OK alone
• Soft-404 and confidence — custom 404 pages are downgraded; scores are explained
• Language — first launch: full banner, then Türkçe / English. Change later in Settings or menu [5]
• Clean upgrade — menu [4] pulls the latest clean tree from GitHub (git, or zip if git is missing)
• Two-pass path discovery — if /admin is 404, still try /index.php/admin and /index/page/admin from live bases (bounded depth / candidates)
• Search-discovery (optional) — in-scope admin/login URL candidates from search results, then the same GET/HEAD + fingerprint pipeline
• discovery_source on every finding: wordlist · smart_path · html · javascript · search · framework
• Reports — HTML dashboard, JSON, CSV, all.txt, NEW/CHANGED/REMOVED vs the previous scan

---

Install

Need: Python 3.10+

Use the same Python binary for pip and main.py.

Linux / macOS / Termux

git clone https://github.com/rootbytex/admin-panel-finder.git
cd admin-panel-finder
python3 -m pip install -r requirements.txt
python3 main.py

Windows (cmd.exe or PowerShell)

git clone https://github.com/rootbytex/admin-panel-finder.git
cd admin-panel-finder
python -m pip install -r requirements.txt
python main.py

If optional HTTP libraries fail to build

curl_cffi and httpx improve TLS fingerprinting. If they fail (common on Termux / some ARM boards), install the core set. The scanner falls back to requests:

python3 -m pip install requests dnspython beautifulsoup4 colorama rich
python3 main.py

---

Usage

Interactive (recommended)

python3 main.py

1. Full ADMIN FINDER banner
2. Language: [1] Türkçe or [2] English (saved for next runs)
3. Main menu:

  [1]  Start scan
  [2]  View results
  [3]  Scan settings
  [4]  Clean upgrade (GitHub)
  [5]  Language
  [0]  Exit

Target format: a root domain, e.g. example.com (not an IP, not a URL path).

Direct scan

python3 main.py example.com
python3 main.py example.com --plain
python3 main.py example.com -v
python3 main.py --help

--plain is for CI, logs, or terminals that cannot animate.

---

Command-line flags

Flag	Meaning
--plain / -q	No animated TUI
--json	Print findings JSON to stdout
--full-ports	Extra high-value ports (Grafana, Jenkins, …). Hosting-panel ports are always checked
--resume	Skip hosts already finished in state.json
--only-admin-hosts	Apex / www plus admin-like hostnames only
--exclude-cdn	Skip cdn / static / img / media hosts
--exclude LABEL	Skip host labels (--exclude blog,dev)
--scope FILE	Extra scope patterns (one per line)
--no-ct / --no-wayback	Disable crt.sh or Wayback path discovery
--framework-detection	Extra CMS/framework admin paths (default: on)
--favicon-fingerprint	Match favicon.ico hashes (default: on)
--search-discovery	Optional search-engine candidates (in-scope URLs only)
--js-discovery	Extract admin/login paths from HTML/JS (default: on)
--scan-history	Write NEW / CHANGED / REMOVED vs last scan (default: on)
--compare FILE	Compare against a previous JSON report
--confidence FILE	Custom scoring weights JSON
--rate / --rate-limit	Global requests per second
--language tr|en	UI language (overrides saved setting)
--threads / --host-concurrency / --timeout	Speed
--output DIR	Report root (default: results)
--proxy URL	HTTP proxy, e.g. http://127.0.0.1:8080
--time-limit N	Stop after N seconds (0 = no limit)
--max-hosts N	Scan at most N in-scope hosts (0 = all)

Settings chosen in the TUI are stored in config/user_settings.json (gitignored).

---

Wordlists

Path	Role
wordlists/admin_paths.txt	Shared admin / login paths (/admin, /login, …)
wordlists/cms/	Product-only CMS paths (WordPress, Joomla, Drupal, Magento, …)
wordlists/frameworks/	Laravel, CodeIgniter, Django, Flask
wordlists/panels/	cPanel, Plesk, Webmin, phpMyAdmin, Grafana, …
wordlists/subdomains.txt	DNS labels

Family files must stay unique. Do not paste /admin into every CMS file — that path already lives in the generic list.

---

Reports

Each scan writes under results/<domain>/:

File	Contents
admin_panels.json	Findings with evidence, confidence, technology
admin_panels.txt / .csv	Human-readable / spreadsheet
report.html	Dashboard
scan_comparison.json	NEW / CHANGED / REMOVED vs previous scan
all.txt	Every GET/HEAD result
200.txt, 401.txt, 403.txt, SOFT404.txt, …	Split by status class
discovered_hosts.txt	In-scope hosts
out_of_scope.txt	Names that were not probed
summary.json	Counts and timing
errors.log	Warnings from the run

---

GitHub About and topics

These tags are meant to rank for admin/login panel search. Copy them into the repository About topics (GitHub does not read hashtags from files as topics):

#admin-panel-finder #login-finder #wordpress-admin-finder #wp-admin #cpanel-finder #plesk-finder #phpmyadmin-finder #joomla-administrator #cms-detection #bug-bounty #pentest-tools #recon #osint #web-security #authorized-scanning

Description (paste into About):

Admin panel finder and login page finder for authorized recon. WordPress, cPanel, Plesk, phpMyAdmin, CMS admin detection. GET/HEAD only.

Topics (one per field, no #):

admin-panel-finder · login-finder · wordpress-admin-finder · cpanel-finder · plesk · phpmyadmin · bug-bounty · pentest-tools · recon · osint · web-security · cms-detection · authorized-scanning

---

Contributing

Wordlists, fingerprints, bug fixes, and docs: see CONTRIBUTING.md.
Pull requests: use the template under .github/.
Conduct: CODE_OF_CONDUCT.md.

Security

How to report a problem in this repository, and what the tool will never do: SECURITY.md.

License

MIT © rootbytex — see LICENSE.