cPanel Detector

Detects active cPanel installations across a list of targets. Built in the context of CVE-2026-41940 research.

Checks common cPanel endpoints, ports, and HTTP response indicators with threading support for large-scale recon.

 @@@@@@@  @@@@@@@    @@@@@@   @@@  @@@  @@@@@@@@  @@@           @@@@@@@  @@@  @@@  @@@@@@@@   @@@@@@@  @@@  @@@  @@@@@@@@  @@@@@@@  
@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@@ @@@  @@@@@@@@  @@@          @@@@@@@@  @@@  @@@  @@@@@@@@  @@@@@@@@  @@@  @@@  @@@@@@@@  @@@@@@@@ 
!@@       @@!  @@@  @@!  @@@  @@!@!@@@  @@!       @@!          !@@       @@!  @@@  @@!       !@@       @@!  !@@  @@!       @@!  @@@ 
!@!       !@!  @!@  !@!  @!@  !@!!@!@!  !@!       !@!          !@!       !@!  @!@  !@!       !@!       !@!  @!!  !@!       !@!  @!@ 
!@!       @!@@!@!   @!@!@!@!  @!@ !!@!  @!!!:!    @!!          !@!       @!@!@!@!  @!!!:!    !@!       @!@@!@!   @!!!:!    @!@!!@!  
!!!       !!@!!!    !!!@!!!!  !@!  !!!  !!!!!:    !!!          !!!       !!!@!!!!  !!!!!:    !!!       !!@!!!    !!!!!:    !!@!@!   
:!!       !!:       !!:  !!!  !!:  !!!  !!:       !!:          :!!       !!:  !!!  !!:       :!!       !!: :!!   !!:       !!: :!!  
:!:       :!:       :!:  !:!  :!:  !:!  :!:        :!:         :!:       :!:  !:!  :!:       :!:       :!:  !:!  :!:       :!:  !:! 
 ::: :::   ::       ::   :::   ::   ::   :: ::::   :: ::::      ::: :::   ::   :::   :: ::::   ::: :::   ::  :::   :: ::::  ::   ::: 
 :: :: :   :         :   : :  ::    :   : :: ::   : :: : :      :: :: :   :   : :  : :: ::    :: :: :   :   :::  : :: ::    :   : : 

---

What It Checks

• Ports: 2082, 2083 (cPanel), 2086, 2087 (WHM), 2095, 2096 (Webmail)
• Endpoints: /cpanel, /whm, /webmail, /cpanel/webcall, /
• HTTP Indicators: Response body keywords, login form detection, redirect patterns
• Headers: X-cPanel-Version and other server fingerprints

---

Installation

git clone https://github.com/expl0itlab/cpanel-checker
cd cpanel-checker
pip install -r requirements.txt

---

Usage

# Single target
python cpanel_checker.py -u https://target.com

# List of targets
python cpanel_checker.py -f targets.txt

# Verbose output + save results
python cpanel_checker.py -f targets.txt -v -o results.json

# Faster scan with more threads
python cpanel_checker.py -f targets.txt -w 20 -t 5

Options

Flag	Description	Default
-u	Target URL(s)	—
-f	File with URLs (one per line)	—
-t	Timeout per request (seconds)	10
-w	Concurrent threads	10
-v	Verbose per-target output	off
-o	Save results as JSON	—
--verify-ssl	Verify SSL certificates	off

---

Output

[+] https://target.com
    Host    : target.com
    Status  : PANEL DETECTED
    Version : 11.110.0.12
    Ports   : cpanel_ssl:2083, whm_ssl:2087
    Paths   : /cpanel, /whm

══════════════════════════════════════════════════════════
  SCAN SUMMARY
══════════════════════════════════════════════════════════
  Targets scanned : 50
  Panels detected : 12
  Active panels   : 12
  Errors          : 1

  Confirmed Panels:
    → https://target.com
    → https://another.com

---

CVE Context

This tool was built during research into CVE-2026-41940, which affects cPanel installations. Use it to identify exposed panels for authorized security assessments.

---

Disclaimer

For authorized security testing and research only. Only use on targets you have explicit permission to test.

---

GitHub: github.com/expl0itlab