Sunday, February 7, 2010

In the following few posts, I will be discussing web development and specifically an eCommerce platform called Magento. For the past little while, I have been installing and configuring Magento for a small business and will share my experiences and mainly the problems I ran into and the solutions I found. (Or didn't...)

I began with the free community version of Magento. Everything went fairly smoothly with the initial install. At one point I was trying to get something working with PHP and was hitting some road blocks,
so I decided to update PHP. That's when everything in Magento broke. Of course, that's not all that broke... [EDIT: I should clarify. It wasn't Magento that broke. It was PHP and Apache. After getting PHP and Apache to play nicely together Magento just worked again.]

First, PHP was not working on Apache. I have Apache 2.2 installed. I updated to PHP 5.3.1 from 5.2.? (maybe 11 or 12.) The problem is that in the Apache config file (httpd.conf), there is a line where you tell Apache about PHP by adding “LoadModule php5_module "c:/php/php5apache2_2.dll"”. (Well, this is one of three places where you tell Apache about PHP.) Anyway, the problem was that PHP 5.3, for some reason I can't fathom, doesn't come with any of the Apache dll files.


*I tried going back to a previous version of PHP: PHP 5.2.12, but then when I navigated to a php page on the server, it came up completely blank. Eventually I put PHP 5.3.1 back on and just copied all of the missing files over from the previous version to the new one without overwriting any of the new files. This includes adding the extentions from the old ext folder to the new one. I also created a new php.ini file from the php.ini-production file that came with PHP 5.3. I made sure that the right extentions were uncommented in the new php.ini as well. (“extension=php_mysql.dll”, “extension=php_pdo.dll”, “extension=php_pdo_mysql.dll”) Now Apache and PHP are working and I can pull up a phpinfo page.


There's still a problem however. When I start the Apache server, it brings up a warning: “PHP Startup: PDO: Unable to initialize module Module compiled with module API=20060613 PHP compiled with module API=20090626 These options need to match”


*The solution to this was to delete “php_pdo.dll” from the ext folder. I had brought it over from the old PHP version, so I guess it is no longer necessary. The other dll files are still necessary though. I also needed to comment “extension=php_pdo.dll” out in the php.ini file. It no longer complains and Apache and PHP seem to still be working as before. Now it's down to the problems with Magento.


When I try to access php pages in Magento, it gives me the following error:

“Fatal error: Method Varien_Object::__tostring() cannot take arguments in
C:\Path_To_Magento\magento\lib\Varien\Object.php on line 488 ”

*I found a solution here: http://spikomoko.wordpress.com/2009/08/19/magento-not-working-on-php-5-3/


File: /lib/Varien/Object.php (Line 484)

Change from

public function ___toString(array $arrAttributes = array(), $valueSeparator=’,')

To this

public function __invoke(array $arrAttributes = array(), $valueSeparator=’,')


File /app/code/core/Mage/Core/Controller/Request/Http.php (Line 274)

Change from

$host = split(‘:’, $_SERVER['HTTP_HOST']);

To this

$host = explode(‘:’, $_SERVER['HTTP_HOST']);


11 | Rob Sperandio

September 19, 2009 at 4:22 am

Your solution is incomplete, after you change the __toString to __toInvoke, add this:

function __toString() {
return $this->__invoke( func_get_arg(0), func_get_arg(1) );
}

18 | alvin
October 1, 2009 at 12:13 pm

There is another file that needs to be changed

File /app/code/core/Mage/Admin/Model/User.php (Line 374)

From:

$nodePath = ‘adminhtml/menu/’ . join(‘/children/’, split(‘/’, $startupPage)) . ‘/action’;

To

$nodePath = ‘adminhtml/menu/’ . join(‘/children/’, explode(‘/’, $startupPage)) . ‘/action’;


!!- This solution doesn't fully work. It got the main Magento page up, but when trying to access the admin page, it threw another error. [EDIT: After everythinig, I realized that the error was due to the fact that I did not uncomment the curl extension. I don't know if that would have fixed it at that point or not. For now it's best to use PHP 5.2, but when it becomes necessary to upgrade, this might be useful.]

I decided to go back to PHP 5.2.12 again to see if I can get it working. The problem is that when I navigate to a Magento page it gives me an Apache error:



I will attempt to resolve the issue.


*I did a search for “magento apache http server has encountered a problem and needs to close” and the first link went to a forum. Someone in that forum suggested another link to another forum here: http://www.apachefriends.org/f/viewtopic.php?f=16&t=32617.

It was somewhat helpful in that I copied “libmysql.dll” to the bin directory in Apache.

This cleared up the whole client side, so I can now access the Magento store fronts.


The problem now is that when I try to access the admin panel, I get a blank page.

I think I reinstalled Apache at some point during this whole issue and it may have lost some information regarding MySQL.


*Here's what happened: It actually wasn't MySQL. I went into the Apache error log after trying to navigate to the admin panel and saw: “PHP Fatal error: Call to undefined function curl_setopt() in ...”. I remembered seeing an extension in php.ini “extension=php_curl.dll”. I uncommented it and bingo! It all works now. SO, it is important to know which extensions are needed by Magento, “http://www.magentocommerce.com/system-requirements” shows which extensions are required. php.ini doesn't have all of those extensions, but so far there have been no problems. I did uncomment “extension=php_gd2.dll” and “extension=php_mcrypt.dll” just to be safe though.

Wednesday, May 20, 2009

Let's get started!

It has been a couple of weeks since I started this blog and already we're almost half way through the term and have completed 6 projects. Now, I'll just explain quickly what penetration testing is for those of you who are unfamiliar with the term. Penetration testing (pen testing) is basically hacking into someone's system or network to find its weaknesses. This is done AT THE REQUEST of the person who owns the system or network! Permission is given and great care must be taken to keep the requesting party completely informed throughout the entire process. A company would much rather have a good guy hack their systems so they can fix their weak points than have a bad guy hack their systems and steal hundreds of credit card numbers.

Anyway, that's the rundown. Suffice it to say that mistakes could lead to an orange jump suit.

Alright, on to the good stuff! Pen testing generally follows these steps:
  • Reconnaissance
  • Scanning
  • Exploitation
  • Maintaining access
  • Evading detection
There are many tools out there to accomplish each step. We'll see some of those tools in future posts. The next posts will mainly be lists of useful Windows and Linux commands.

Links for this post:
http://en.wikipedia.org/wiki/Penetration_testing
http://www.isecom.org/osstmm/
http://www.hackerhighschool.org/

Sunday, May 3, 2009

Welcome

The first several entries in this blog will pertain to computer security in which I will document my experiences with penetration testing as I learn new skills from a class that I am taking. I hope to continue posting entries after the class is over, but will expand into other technical areas beyond security alone. I will also, at times, write about my other personal interests such as video games or movies. Hopefully my personality will start coming out as the blog progresses and I hope you enjoy reading it.