Month: December 2016

How to crack or hack (investigate vulnerabilities) of a Magento Website

stephen Magento, Security

It is actually rather simple to find vulnerabilities and extract information for a magento site. The developers are usually caught up in feature development instead of maintaining and securing the server. Many times the developers take on the role of system administrators and problems are only picked up after it is too late.

Finding a Target

There are a few ways to do this but the main thing is the store needs to be magento. So I advise installing Wappalyser which will tell you whether the site you are currently on is Magento.

Another way is browsing forums and q/a places for people encountering problems with magento where they actually just give the URL of the production site.

Sometimes just going to popular ecommerce stores and watching the wappalyser plugin can help isolate targets.

Sometimes people just post public gists of vulnerable sites like this list of Magento vulnerable sites or 5900 sites found to be skimming payment info

Scan the Site

There is a nice tool available which will give you info about the site, possible vulnerable extensions it has installed and all a list of locations that are not hidden from the public. This is the tool you would least expect to work but it is in fact the best tool to use. You will be surprised how many installations allow public users to view things they shouldn't.

The tool is called Magescan.

Run it with php magescan.phar scan:all http://example.com

This will give you results like:


 Magento Information  
                       

+-----------+------------------+
| Parameter | Value            |
+-----------+------------------+
| Edition   | Community        |
| Version   | 1.9.2.1, 1.9.2.2 |
+-----------+------------------+

                     
  Installed Modules  
                     

No detectable modules were found

                       
  Catalog Information  
                       

+------------+-------+
| Type       | Count |
+------------+-------+
| Categories | 14    |
| Products   | 1146  |
+------------+-------+

           
  Patches  
           

+------------+---------+
| Name       | Status  |
+------------+---------+
| SUPEE-5344 | Unknown |
| SUPEE-5994 | Unknown |
| SUPEE-6285 | Unknown |
| SUPEE-6482 | Unknown |
| SUPEE-6788 | Unknown |
| SUPEE-7405 | Unknown |
| SUPEE-8788 | Unknown |
+------------+---------+

           
  Sitemap  
           

Sitemap is not declared in robots.txt
Sitemap is accessible: http://www.example.com/sitemap.xml

                     
  Server Technology  
                     

+--------------+-------------------------+
| Key          | Value                   |
+--------------+-------------------------+
| Server       | Apache                  |
| X-Powered-By | PHP/5.6.29-1~dotdeb+7.1 |
+--------------+-------------------------+

                          
  Unreachable Path Check  
                          

+----------------------------------------------+---------------+--------+
| Path                                         | Response Code | Status |
+----------------------------------------------+---------------+--------+
| .bzr/                                        | 404           | Pass   |
| .cvs/                                        | 404           | Pass   |
| .git/                                        | 404           | Pass   |
| .git/config                                  | 404           | Pass   |
| .git/refs/                                   | 404           | Pass   |
| .gitignore                                   | 404           | Pass   |
| .hg/                                         | 404           | Pass   |
| .idea                                        | 404           | Pass   |
| .svn/                                        | 404           | Pass   |
| .svn/entries                                 | 404           | Pass   |
| admin/                                       | 200           | Fail   |
| admin123/                                    | 404           | Pass   |
| adminer.php                                  | 404           | Pass   |
| administrator/                               | 404           | Pass   |
| adminpanel/                                  | 404           | Pass   |
| aittmp/index.php                             | 404           | Pass   |
| app/etc/enterprise.xml                       | 403           | Pass   |
| app/etc/local.xml                            | 403           | Pass   |
| backend/                                     | 404           | Pass   |
| backoffice/                                  | 404           | Pass   |
| beheer/                                      | 404           | Pass   |
| capistrano/config/deploy.rb                  | 404           | Pass   |
| chive                                        | 404           | Pass   |
| composer.json                                | 200           | Fail   |
| composer.lock                                | 404           | Pass   |
| config/deploy.rb                             | 404           | Pass   |
| control/                                     | 404           | Pass   |
| dev/tests/functional/etc/config.xml          | 200           | Fail   |
| downloader/index.php                         | 200           | Fail   |
| index.php/rss/order/NEW/new                  | 401           | Pass   |
| info.php                                     | 200           | Fail   |
| mageaudit.php                                | 404           | Pass   |
| magmi/                                       | 404           | Pass   |
| magmi/conf/magmi.ini                         | 404           | Pass   |
| magmi/web/magmi.php                          | 404           | Pass   |
| manage/                                      | 404           | Pass   |
| management/                                  | 404           | Pass   |
| manager/                                     | 404           | Pass   |
| modman                                       | 200           | Fail   |
| p.php                                        | 404           | Pass   |
| panel/                                       | 404           | Pass   |
| phpinfo.php                                  | 200           | Fail   |
| phpmyadmin                                   | 404           | Pass   |
| README.md                                    | 200           | Fail   |
| README.txt                                   | 404           | Pass   |
| shell/                                       | 403           | Pass   |
| shopadmin/                                   | 404           | Pass   |
| site_admin/                                  | 404           | Pass   |
| var/export/                                  | 403           | Pass   |
| var/export/export_all_products.csv           | 403           | Pass   |
| var/export/export_customers.csv              | 403           | Pass   |
| var/export/export_product_stocks.csv         | 403           | Pass   |
| var/log/                                     | 403           | Pass   |
| var/log/exception.log                        | 403           | Pass   |
| var/log/payment_authnetcim.log               | 403           | Pass   |
| var/log/payment_authorizenet.log             | 403           | Pass   |
| var/log/payment_authorizenet_directpost.log  | 403           | Pass   |
| var/log/payment_cybersource_soap.log         | 403           | Pass   |
| var/log/payment_ogone.log                    | 403           | Pass   |
| var/log/payment_payflow_advanced.log         | 403           | Pass   |
| var/log/payment_payflow_link.log             | 403           | Pass   |
| var/log/payment_paypal_billing_agreement.log | 403           | Pass   |
| var/log/payment_paypal_direct.log            | 403           | Pass   |
| var/log/payment_paypal_express.log           | 403           | Pass   |
| var/log/payment_paypal_standard.log          | 403           | Pass   |
| var/log/payment_paypaluk_express.log         | 403           | Pass   |
| var/log/payment_pbridge.log                  | 403           | Pass   |
| var/log/payment_verisign.log                 | 403           | Pass   |
| var/log/system.log                           | 403           | Pass   |
| var/report/                                  | 403           | Pass   |
+----------------------------------------------+---------------+--------+

So we get some pretty juicy information here. Often the Unreachable Path Check fails, give the best results.

Just go to those locations check it out you might get a nice readme.md or some db credentials.

There are also some other files you could look out for, like this Simple PHP file manager called file_manager.php. Some developers just don't care and commit this file in the root of a magento site. So anyone accessing the file can actually delete every file on a production server.

Next Steps

The information has now been gathered the next step is up to you...

Summary of Princes of Yen Movie

stephen Finance

The Princes of Yen a documentary movie created from the book of the same name. The author Richard Weiner, a renowned and knowledgable economist unlocks the key decisions, ingredients and consequences of Japan's post-war economy.

Here is a summary of some of the profound points:

Princes of Yen

After the war was over bank loan books deteriorated. Most of the assets the bank held were war bonds and loans to destroyed industries and were hence worthless. The banking sector was virtually bankrupt.

The Central bank of Japan would buy the books, paying good (state) reserves money for assets that were worthless.

Americans facilitated land reform - ownership of land going from owners to workers. The capitalist elite were purged as war criminals.

The central bank gave window guidance to individual commercial banks to the amount and to which sectors loans should be given.

So the central bank could decide which projects should be advanced and which should be shunned

The central bank did this initially to raise the quality of life of the Japanese.

There were some undesirable consequences: companies would not fight for profitability, they would fight for market share. Cartels were introduced to stop excess competition. New entrants and new technology was suppressed.

Japanese companies became dominant in many markets in the world.So window guidance or central bank control became the best argument against free markets.

A war economy where production of weapons was shifted to consumer goods.

They needed a crisis significantly large to remove the vested interest of the ministry of finance in the war economy to move to full american style capitalism.
The crisis convinced the need for change, creating a crisis is the only way for no-one to stop you.

Window guidance increased loan quotas, fuelling a credit boom. Young people in their 20's and 30's could buy second homes on modest salaries. It also caused a boom in stock market as well as property.

Economists were tasked to justify the high land prices and some came up with  'scarcity' as the reason.

The labour market boomed sparking fears of a labour shortage, so companies invited final year university students to holiday resorts.

Government also loved it (the increased loan quotas) because tax revenues went up.

Normal manufacturers expanded their finance and treasury divisions to speculate on the market. Some companies like Nissan made more money on the stock market than selling cars.

Some economists said rising productivity explained the performance of Japan's economy.

In reality Window guidance was creating a giant bubble not Japanese management techniques.

Banks had to expand and extend loans to non-productive borrowers. If there is no growth in demand from low risk borrowers, risk is needed to increase to fulfil quota.

The banking system fuelled the creation of new money and hence the bubble.

Banks would value land very highly so they could fulfil loan quota.

When a country creates too much money, it spills over as international investment. Assets like art and valuables were purchased by Japanese. Buying a staggering 75% of US treasury bonds.

It is difficult to just print money and go on a shopping spree. It only works if markets do not devalue your currency.

America did the same thing where they created money and exchanged it for other strong currency because of the dollar gold standard. Japan did the same thing and it worked because of a significant trade surplus.

Ratio of Non-GDP loans (Money generating) to total loans increases in countries that can be struck by banking crisis.

America golden 1920's used stocks as collateral for loans. Taking stock price as given, created new money. More money in stock market caused stock prices to rise. Accepting certain percentage of stock as collateral, all banks drove up value.

Growth stopped and window guidance was abolished. Banks realised the majority of 99 trillion yen in loans were going to turn sour they became fearful and stopped loans to speculators and even good (low risk) loans.

This caused 5 million Japanese to lose their jobs. Suicide became leading cause of death for men between the ages of 20 and 44. Between 1990 and 2003, 212 companies went bankrupt. The stock market dropped 80%, land prices fell by 84%. Economists felt relieved as their uncomfortable outlook came to fruition.

The ministry of finance started thinking that interest rates were the main policy tool so they put pressure on the bank of Japan to lower interest rates. Yet to date there is no empirical evidence that lower interest rates lead to increasing GDP growth.

The ministry of finance asked the bank of Japan to sell lots of yen and buy USD. So the value of the Yen would fall, making it cheaper for other countries to import Japanese products causing Japanese exports to pick up.

The Yen remained strong as the BOJ was sterilising the Yen - manipulating the value of domestic currency.
The central bank can inject money into the economy by buying assets and withdraw money by selling assets; increasing or decreasing the amount of money in the economy.

Observers suggested domestic demand had to be boosted by government spending. Then loan demand would rise. Government debt was boosted to historic levels. Fundraising was taken from the bond market. So it didn't change the amount of money out there (Money supply). Government debt subsequently increased massively to 220% of GDP.

This caused the circular argument of "no loan growth, forcing no economic growth because of of no loan growth". The central bank was losing sight of it's job, which is to print money.

The central bank can buy out the commercial banks' bad debt with newly created money. Paying face value for assets.

Which was enhanced by the central bank cornering a market and creating a mini bubble in a market that bank invest heavily to create a large profit for them. For this the tax payer should fit the bill...

"A central bank can increase the amount of money in an economy without limit by simply buying assets from the private sector and paying with newly created credit"

The scenario was:

  • The economy needs money creation
  • Banks need to rid themselves of bad debt
  • Property needs transactions

To fix this scenario the Central bank could print money, buy land from banks and turn the land into parts?

Quantitative easing is another way to inject money into economy.

They could have done this but then nothing would have changed in the economy and economic thinking of the Japanese public. They wanted a crisis, a structural change.
The Bank of Japan was refusing to create more money, they would reduce the money and worsen the recession.
The reason for this was Japan's economic structure. Monetary easing could produce harm in a delay of structural adjustment.

Turning the war economy into forcing money into sectors selling commercial goods was unknown to incoming/rising workers, they thought it was free market.

The free market gives stock market the control instead of banks, to make people withdraw money from secure banks and put into stock market. Reformers withdrew guarantees and tax benefits on stock investments. Unemployment rose, income and wealth disparities rose.
Putting tax money into banks, nationalising and bankrupting large firms. Foreclosing on borrowers. Weakening the balance sheets of banks.

Vulture funds (largest operator Goldman Sachs)