> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/cms/magento.md).

# Magento

**Magento** is an open-source e-commerce platform written in **PHP**. Magento source code is distributed under the Open Software License. Magento was acquired by Adobe Inc in May 2018 for $1.68 billion.

## Mage scan

To run all scans

```bash
php magescan.phar scan:all http://swagshop.htb
```

## Usage information

<details>

<summary>magescan.phar -h</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/SwagShop]
└─$ php magescan.phar -h
Usage:
  help [options] [--] [<command_name>]

Arguments:
  command               The command to execute
  command_name          The command name [default: "help"]

Options:
      --xml             To output help as XML
      --format=FORMAT   The output format (txt, xml, json, or md) [default: "txt"]
      --raw             To output raw command help
  -h, --help            Display this help message
  -q, --quiet           Do not output any message
  -V, --version         Display this application version
      --ansi            Force ANSI output
      --no-ansi         Disable ANSI output
  -n, --no-interaction  Do not ask any interactive question
  -v|vv|vvv, --verbose  Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug

Help:
  The help command displays help for a given command:
  
    php magescan.phar help list
  
  You can also output the help in other formats by using the --format option:
  
    php magescan.phar help --format=xml list
  
  To display the list of available commands, please use the list command.

```

</details>

<details>

<summary>magescan.phar list</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Hack_the_Box/HTB_Machines/Easy_Machines/SwagShop]
└─$ php magescan.phar list     
Mage Scan version 1.12.9

Usage:
  command [options] [arguments]

Options:
  -h, --help            Display this help message
  -q, --quiet           Do not output any message
  -V, --version         Display this application version
      --ansi            Force ANSI output
      --no-ansi         Disable ANSI output
  -n, --no-interaction  Do not ask any interactive question
  -v|vv|vvv, --verbose  Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug

Available commands:
  help              Displays help for a command
  list              Lists commands
 scan
  scan:all          Run all scans
  scan:catalog      Get catalog information
  scan:modules      Get installed modules
  scan:patch        Get patch information
  scan:server       Check server technology
  scan:sitemap      Check sitemap
  scan:unreachable  Check unreachable paths
  scan:version      Get the version of a Magento installation

```

</details>

## Resources

Magento - Wikipedia: <https://en.wikipedia.org/wiki/Magento>

Mage Scan - GitHub: <https://github.com/steverobbins/magescan>