I have a custom admin url, still I saw someone trying to login into admin.

I even changed it, and shortly after the next login was tried.

How could this happen, I thought its secure?

  • This is security through obscurity which is not a good practice. It doesn't matter if people try to login to your admin URL as long as they aren't successful. – Frank May 7 '15 at 1:15
  • No matter how cleverly generic the custom Admin URL, it's probably been used before. A library of admin type URLs is readily available to scan a website. Try another tack. You don't need to be sitting in your local Starbucks working on your website backend. Use .htaccess to limit by IP address the access to /admin and /downloader. – Fiasco Labs May 7 '15 at 3:48
  • See also magehero.com/posts/886/… – Willem May 7 '15 at 5:49
  • 2
    the funniest is that many users put this custom path to their robots.txt, as Disallow... and all the other links/files i always get from robots.txt, why they do this is beyond my imagination... – user2857 May 7 '15 at 8:40
  • Another way. Ouch, what was the point? => magento.stackexchange.com/questions/68003/… – Fiasco Labs May 17 '15 at 0:43

There are a handful of ways your admin url can be exposed. Some include

  • Modules that incorrectly create admin controllers. Visiting a known, improper, admin frontname will redirect to the login screen. For instance, hitting example.com/mymodule_admin/foo/bar. A "safe" admin controller will extend on top of your customadmin frontname, like example.com/customadmin/mymodule/foo_bar.
    • There is a fix for this with SUPEE-6788, but it's a setting you have to change manually.
  • The URL is visible in the XML response of example.com/index.php/rss/order/NEW/new.
    • Fixed with SUPEE-6285
  • Some web hosts create access logs in public areas, like example.com/access_logs. An attacker could look through these logs and sniff out promising URLs.
  • Visiting an improperly secured admin controller (e.g. example.com/downloadable/Adminhtml_Downloadable_File/upload)
    • Fixed with SUPEE-5994
  • You probably haven't noticed the downloader url (example.com/downloader). Though it's safe behind a login screen, if brute forced an attacker can navigate back to your admin url.

Security through obscurity isn't secure at all. To be safe you should protect your admin interface. This can be done with IP filtering, captchas, rate limits, etc. And, of course, use strong passwords. After all, seeing your admin login screen isn't actually a problem. It's only a problem is an unauthorized user gets in.

  • 4
    Also worth mentioning: Use Magento Guest Audit to scan your site. You'd be surprised at how much you reveal to visitors. (web interface is new, needs work) – Steve Robbins May 7 '15 at 5:52
  • 1
    Bullet point one is addressed finally by SUPEE-6788. Install it, upgrade any modules that won't work with it, disable Admin Routing Compatibility Mode. This => github.com/rhoerr/supee-6788-toolbox tells you which modules are likely to allow the bypass. – Fiasco Labs Nov 16 '15 at 19:34

The reality is, security by obfuscation nearly never works. I assume it does not even protect you from script kiddies.

But to this case. There are admin modules using their own routes for the admin urls, not using your custom admin url. Payment modules are likely to do this for example(I found 4 of them at our shop).

You can finde some on github with https://github.com/search?p=1&q=AdminController+%22extends+Mage_Adminhtml_Controller_Action%22&ref=searchresults&type=Code&utf8=%E2%9C%93
I assume every controller class not containing _Adminhtml_ is usable for this.

side note, custom url for admin, but not for /downloader ? just brutforce an admin user there, and you get the admin url from there.

  • Really interesting. Thanks for the share. Which payment modules are you using out of interest? – Shaughn May 6 '15 at 22:16
  • 2
    This is also currently possible on a vanilla Magento installation. Just hit a certain url and it takes you to the admin route (custom or not). – James Anelay - TheExtensionLab May 6 '15 at 23:28
  • @JamesAnelay Care to share with the rest of the class? – Steve Robbins May 7 '15 at 5:18
  • @JamesAnelay Magento are currently working on this. They would probably appreciate not spreading the information. – Peter O'Callaghan May 7 '15 at 8:49
  • 1
    It's better to use a Web Application Firewall or .htaccess lockdown rules against admin, connect and downloader functions than to cross your fingers and obscure. Passive methods like SBO (Security by Obscurity) have no teeth, they take care of no security issue, just move its access in the hopes you get lucky. It's what I call the picket fence method of security, there are gaps between the slats and the attacks are always able to fit through the gaps. – Fiasco Labs Sep 5 '15 at 20:38

A very nice one is when it appears on similarweb.com because you use a chatty browser-plugin ... (http://www.howtogeek.com/180175/warning-your-browser-extensions-are-spying-on-you/)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.