Joomla

Scan

droopescan scan joomla --url http://corp.com

RCE After Login

Extensions > Templates > Templates > error.php

LFI (1.5.0 - 3.9.4)

python2.7 joomla_dir_trav.py --url "http://corp.com/administrator/" --username admin --password admin --dir /