0

I've inherited a large magento application with a huge number of extensions, and have been tasked with finding all accessible urls which match certain criteria (meaning I must look manually).

I'm trying to find a way of finding all urls exposed by modules as creating a sitemap didn't do this for me.

  • I build a POC for this a while ago as a magerun add-on. Meant to provide a list of module urls for penetration testing. It works but not rock solid. It shows if controllers use $_POST and $_GET variables as well. I'm willing to open-source it on github if people are interested in contributing. It basically reads out the xml files of each module and parses the controller functions code to get this info. The idea was to have something similar to symfony's router:debug command in which I succeeded for the most part. It ain't pretty though. – FROSIT Oct 6 '17 at 15:11
  • Thanks for replying - that would be really helpful. I'd also be interested in contributing to the project if you were looking for participants. – ol'bob dole Oct 6 '17 at 15:54
  • I found the project and made an asciicast for you to see how it works. asciinema.org/a/CAyJirKDAasfgTsIqToQkqQW5. If this is what your looking for, I'll do a little refactoring and publish the project together with an answer post asap. – FROSIT Oct 6 '17 at 16:39
0

There was an example extension in one of my Magento U courses that I changed to fit a similar purpose. There may be some tweaking necessary, but the resulting module will give you the handle for any controller-actions and the url (that is the modification I made) in it's own log file, eventlog.log. The code that I have looks like this:

app/etc/modules/Test_Loghooks.xml

<?xml version="1.0"?>
<config>
    <modules>
         <Test_Loghooks>
            <active>true</active>
            <codePool>local</codePool>
         </Test_Loghooks>
    </modules>
</config>

app/code/local/Test/Loghooks/etc/config.xml

<?xml version="1.0" encoding="UTF-8"?>
<config>
    <modules>
        <Test_Loghooks>
            <version>0.1</version>
        </Test_Loghooks>
    </modules>
    <global>
        <models>
            <Loghooks>
                <class>Test_Loghooks_Model</class>
            </Loghooks>
        </models>
        <events>
            <controller_action_predispatch>
                <observers>
                    <Loghooks>
                        <type>singleton</type>
                        <class>Loghooks/observer</class>
                        <method>controller_action_predispatch</method>
                    </Loghooks>
                </observers>
            </controller_action_predispatch>
        </events>
    </global>
</config>

app/code/local/Test/Loghooks/Model/Observer.php

<?php
class Test_Loghooks_Model_Observer {
    public function controller_action_predispatch($observer) {
        $_fullActionName = $observer->getEvent ()->getControllerAction ()->getFullActionName ();
        Mage::log ( $_fullActionName.' | '.Mage::helper('core/url')->getCurrentUrl(),null, 'eventlog.log' );
    }
}
?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.