CKEditor Passive Scanner

CKEditor Passive Scanner detects CKEditor installations (v4.x and v5.x) in HTTP responses, extracts version information, and enumerates loaded plugins, all without sending any active requests to the target.

Features

• Passively identifies CKEditor through response bodies, including JavaScript, CSS, HTML markers, and CKEDITOR.version references
• Extracts exact version numbers for CKEditor 4 and identifies CKEditor 5 editor types such as Classic, Inline, Balloon, and Decoupled
• Enumerates loaded plugins discovered in responses, including file uploaders and image processors
• Calculates the most likely installation base path from observed traffic
• Reports findings as Information severity issues visible in the Dashboard and Target → Site map
• Operates entirely passively with no active payloads sent, respecting scope and scanner settings

Usage

1. Proxy your target applications traffic and browse it normally.
2. The extension automatically inspects HTTP responses as they pass through the proxy.
3. Open the Dashboard or navigate to Target → Site map and look for Information severity issues labeled CKEditor Detected (CKEditor 4) or CKEditor Detected (CKEditor 5).
4. Select an issue to view its details, which include the detected editor type and version, the signature that triggered detection, the calculated base path, and any discovered plugins.