Sansec

https://sansec.io/guides
Admin
Sansec provides comprehensive guides and documentation on e-commerce security, vulnerability...
Tokens:28,765
Snippets:510
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Manual Scanner Installation (Linux amd64)

Source: https://sansec.io/guides/usage

Manually install the eComscan binary for Linux amd64 systems by downloading, saving to ~/bin, and making it executable.

```bash
mkdir -p ~/bin
curl https://ecomscan.com/downloads/linux-amd64/ecomscan -o ~/bin/ecomscan
chmod 755 ~/bin/ecomscan

```

--------------------------------

### Install eComscan Binary

Source: https://sansec.io/guides/adobe-commerce-cloud

Installs the eComscan binary to a writable partition on the Adobe Commerce Cloud server. Ensure the directory exists and the script has execute permissions.

```bash
mkdir -p /mnt/shared/$LOGNAME/sansec
curl https://sansec.io/downloads/linux-amd64/ecomscan -o /mnt/shared/$LOGNAME/sansec/ecomscan
chmod 755 /mnt/shared/$LOGNAME/sansec/ecomscan
```

--------------------------------

### Start a Single Store Scan

Source: https://sansec.io/guides/usage

Execute a single scan of your store's root folder, specifying a report email and the store path.

```bash
~/bin/ecomscan --report=your@email /path/to/store/root/folder

```

--------------------------------

### Scan with License Key and Report Email

Source: https://sansec.io/guides/usage

Perform a scan using a provided license key and specify an email address for detailed reporting. This example uses a Magento store path.

```bash
~/bin/ecomscan --key=n8sFtfpWzz --report=admin@yourstore.com /var/www/magento

```

--------------------------------

### Example Output for eComscan Permissions and User ID

Source: https://sansec.io/guides/how-ecomscan-works-behind-the-scenes

This is an example of the expected output when checking eComscan program permissions and the user ID. It shows the file permissions and the user/group details.

```bash
$ ls -la `which ecomscan`
-rwxr-xr-x 1 app app /data/web/bin/ecomscan
$ id
uid=1000(app) gid=1000(app) groups=1000(app)
```

--------------------------------

### Install and Configure Sansec Shield

Source: https://sansec.io/guides/sansec-shield

Install the Shield composer module, configure Magento, and sync protection rules. Ensure you have a Sansec Advanced or Enterprise license key.

```bash
# Install Shield module
composer require sansec/magento2-module-shield

# Configure Magento
bin/magento setup:upgrade
bin/magento config:set sansec_shield/general/license_key YOURKEY
bin/magento cache:clean

# Sync protection rules
bin/magento sansec:shield:sync-rules
```

--------------------------------

### Inspect Process Information

Source: https://sansec.io/guides/how-to-inspect-deleted-process-file

Use these commands to gather details about a process, such as its start time, command line, and open sockets. Replace `<pid>` with the actual process ID.

```bash
# Start-time of process
ps -o pid,lstart,cmd <pid>

# All open sockets of process
lsof -np <pid>

# Generic checks on process
cat /proc/<pid>/environ
cat /proc/<pid>/cmdline
strings /proc/<pid>/exe
```

--------------------------------

### Webscale Stratus Cronjob Command

Source: https://sansec.io/guides/usage

Example cronjob command for Webscale Stratus hosting, which requires using their specific panel for cronjob entries.

```bash
/srv/bin/ecomscan --key <your_key> --monitor <your_email> /srv/public_html

```

--------------------------------

### Schedule Daily Self-Update

Source: https://sansec.io/guides/troubleshooting

A cron job example to schedule a daily self-update for eComscan, intended to be run by root for system-wide installations.

```cron
1 1 * * * root /path/to/ecomscan --self-update
```

--------------------------------

### Sample CSP Header

Source: https://sansec.io/guides/csp-sri

A Content Security Policy header example that restricts resource loading to self, Google Analytics scripts, and Google fonts.

```http
Content-Security-Policy:
    default-src 'self';
    script-src https://www.google-analytics.com;
    font-src fonts.gstatic.com;

```

--------------------------------

### Example Crontab Entry for PATH Configuration

Source: https://sansec.io/guides/troubleshooting

Illustrates how to configure the PATH environment variable in a crontab to ensure cron jobs use the correct Composer binary. Ensure the directory with the updated Composer binary precedes any directory with an older version.

```bash
PATH=/usr/local/bin:/usr/bin:/bin:/home/user/bin

0 2 * * * ~/bin/ecomscan -k <key> --monitor <youremail> <storepath>

```

--------------------------------

### Run Interactive Scan

Source: https://sansec.io/guides/troubleshooting

Use this command to verify eComscan installation and functionality. It sends a report to your inbox upon successful completion.

```bash
~/bin/ecomscan -k <key> --report <youremail> <storepath>
```

--------------------------------

### Successful PGP Signature Verification Output

Source: https://sansec.io/guides/pgp-key

This is an example of the output you should see if the eComscan binary's signature is valid and matches the Sansec PGP key. Pay attention to the 'Good signature' and 'Primary key fingerprint'.

```text
gpg: Signature made Mon May 31 12:54:34 2021 UTC using RSA key ID 23AD53F7
gpg: Good signature from "Sansec BV <info@sansec.io>"
Primary key fingerprint: 7EB6 04FB 24FB 3A8B 61F1  70EA 9D0D 094C D2C7 E669
     Subkey fingerprint: 2C94 7FF1 36A5 DD1C 0DED  57C6 7547 8737 23AD 53F7

```

--------------------------------

### Check for Linux iconv RCE Vulnerability (CVE-2024-2961) using C

Source: https://sansec.io/guides/iconv-glibc

This snippet downloads, compiles, and runs a C proof-of-concept exploit to check for the CVE-2024-2961 vulnerability. Ensure you have `curl` and `gcc` installed.

```bash
curl -sO https://sansec.io/downloads/cve-2024-2961.c &&
gcc cve-2024-2961.c -o poc &&
./poc

```

--------------------------------

### Get File Timestamps with stat

Source: https://sansec.io/guides/magento-root-cause-analysis

Use the 'stat' command to retrieve detailed file information, including 'Access', 'Modify', and 'Change' timestamps. The 'Change' timestamp is often more reliable than 'Modify' as it cannot be spoofed without administrator access.

```bash
$ stat app/webshell.php
  File: app/webshell.php
  Size: 29624       Blocks: 27         IO Block: 16384  regular file
Device: 1000f6h/1048822d  Inode: 437073      Links: 1
Access: (0644/-rw-r--r--)  Uid: (11134/webserver)   Gid: (11134/webserver)
Access: 2019-04-03 05:48:25.991900869 +0000
Modify: 2013-07-04 03:11:18.734417791 +0000
Change: 2019-04-03 05:48:26.531897938 +0000
 Birth: -
```

--------------------------------

### Check System Performance with top

Source: https://sansec.io/guides/troubleshooting

Use the 'top' command to monitor system resource usage, specifically checking the '(st)eal' column to identify oversold virtual server conditions.

```bash
top
```

--------------------------------

### Set Up Continuous Monitoring via Cronjob

Source: https://sansec.io/guides/usage

Add a cronjob to run eComscan every 10 minutes for continuous monitoring. Replace placeholders for key, email, and store path.

```bash
10 * * * * ~/bin/ecomscan --key=<your_key> --monitor=<email1,email2,email3,...> <store_path>

```

--------------------------------

### eComscan Command Line Help

Source: https://sansec.io/guides/integration

View all available command line options for eComscan. This is useful for understanding the full range of configurations.

```bash
ecomscan --help
```

--------------------------------

### Create Backups of Process Files

Source: https://sansec.io/guides/how-to-inspect-deleted-process-file

Before terminating a suspicious process, create backups of its executable, environment variables, and command line arguments. This is useful even if the original executable has been removed.

```bash
cp /proc/<pid>/exe /tmp/rogue.executable
cp /proc/<pid>/environ /tmp/rogue.environ
cp /proc/<pid>/cmdline /tmp/rogue.cmdline
```

--------------------------------

### Limit CPU Usage for eComscan

Source: https://sansec.io/guides/advanced-scanning

Use this command to limit the CPU usage of eComscan to 50%, preventing it from exceeding auto-scaling thresholds. Ensure `cpulimit` is installed and eComscan is in your bin directory.

```bash
cpulimit --limit 50 ~/bin/ecomscan [...]
```

--------------------------------

### eComscan Site License Key via Environment Variable

Source: https://sansec.io/guides/integration

Provide your eComscan site license key using the ECOMSCAN_KEY environment variable for enhanced security. This is recommended over providing it as a command line option.

```bash
--key=KEY
```

--------------------------------

### Import Configuration and Clear Cache

Source: https://sansec.io/guides/magento-csp

After updating env.php, import the configuration and clear the cache to apply the changes. This ensures the new CSP settings are active.

```bash
bin/magento app:config:import
bin/magento cache:clean config

```

--------------------------------

### Log Scans to File and Email Alerts

Source: https://sansec.io/guides/integration

Configure a cron job to log eComscan results to a file and send email alerts for new findings. Requires `moreutils` for `ifne`.

```bash
ecomscan --newonly --key <key> --format=csv <path> \
  tee -a /var/log/ecomscan.log | ifne mail -s "eComscan Alert" tech@your.com
```

--------------------------------

### Scan Multiple Folders with eComscan

Source: https://sansec.io/guides/faq

When using providers that set up different root folders per storefront via symlinks, scan the parent folder (e.g., your home directory) to include all storefronts. Refer to advanced scanning instructions for cluster environments.

```bash
ecomscan --deep
```

--------------------------------

### Set SSH Permissions

Source: https://sansec.io/guides/grant-store-access

Ensure correct permissions are set for the .ssh directory and the authorized_keys file for secure SSH access.

```bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
```

--------------------------------

### Configure eComscan for Multiple Email Reports

Source: https://sansec.io/guides/faq

Set up eComscan to send reports to multiple email addresses by listing them after the `--report` or `--monitor` flag, separated only by commas. Ensure there are no spaces between the email addresses.

```bash
ecomscan --monitor mike@you.com,joe@you.com,it@you.com
```

--------------------------------

### Submit File for Analysis

Source: https://sansec.io/guides/submit-samples

Use this command to submit a suspicious file or a false positive to Sansec for analysis. Replace PATH_TO_FILE with the actual path to the file you want to submit.

```bash
ecomscan submit PATH_TO_FILE

```

--------------------------------

### Import Sansec PGP Public Key

Source: https://sansec.io/guides/pgp-key

Use this command to import the Sansec public PGP key into your GnuPG keyring. This is the first step to verifying eComscan releases.

```bash
curl https://sansec.io/downloads/sansec.pubkey.txt | gpg --import

```

--------------------------------

### Access eComscan Key from File

Source: https://sansec.io/guides/adobe-commerce-cloud

Safely stores the eComscan license key in a file and accesses it using command substitution. This prevents the key from being stored directly in the source repository.

```bash
/mnt/shared/$LOGNAME/sansec/ecomscan -k $(cat /mnt/shared/$LOGNAME/sansec/license.txt) /app/$LOGNAME
```

--------------------------------

### Run eComscan with Slack Integration

Source: https://sansec.io/guides/slack-integration

Execute eComscan to send new malware alerts to a specified Slack channel. Ensure you replace placeholders with your actual webhook URL, API key, and scan path.

```bash
ecomscan --newonly --slack <webhookurl> --key <yourkey> <scanpath>
```

--------------------------------

### Run eComscan with Verbose Flag

Source: https://sansec.io/guides/faq

Use the `--verbose` flag when running eComscan manually for the first time to verify interactions with Fastly. This can help diagnose potential issues if Fastly's WAF is blocking requests.

```bash
ecomscan --verbose
```

--------------------------------

### Block DirtyFrag Kernel Modules

Source: https://sansec.io/guides/dirty-frag

Use this command to create a configuration file that prevents the vulnerable modules from loading. It also attempts to unload them if they are currently active. Only blacklist IPsec ESP modules if your server does not use IPsec VPNs.

```bash
cat > /etc/modprobe.d/dirtyfrag.conf <<EOF
install rxrpc /bin/false
install esp4 /bin/false
install esp6 /bin/false
EOF
rmmod rxrpc esp4 esp6 2>/dev/null || true
```

--------------------------------

### Check eComscan Program Permissions and User ID

Source: https://sansec.io/guides/how-ecomscan-works-behind-the-scenes

Run these commands to verify the permissions of the eComscan program and the user ID running it, which is important for the self-update feature.

```bash
ls -la `which ecomscan`
id
```

--------------------------------

### Post Alerts to Generic Webhook

Source: https://sansec.io/guides/integration

Use this script to send eComscan alerts to a custom webhook. Ensure the webhook URL is correctly configured.

```bash
ecomscan --format=json --newonly --key=<key> <path> | ifne curl -X -H 'Content-Type: application/json' -d@- <webhookURL>
```

--------------------------------

### Configure CSP Report-Only Mode in env.php

Source: https://sansec.io/guides/magento-csp

Set CSP to report-only mode for storefront checkout and admin routes, and enable inline scripts. This configuration helps identify violations without blocking functionality.

```php
<?php
return [
    [...] 
    'system' => [
        'default' => [
            'csp' => [
               'mode' => [
                  'storefront_checkout_index_index' => [
                     'report_only' => '1'
                  ],
                  'admin_sales_order_create_index' => [
                    'report_only' => '1'
                  ]
               ],
               'policies' => [
                  'storefront_checkout_index_index' => [
                    'scripts' => [
                        'inline' => '1'
                    ]
                  ],
                  'admin_sales_order_create_index' => [
                    'scripts' => [
                        'inline' => '1'
                    ]
                  ]
               ]
            ]
        ]
    ]
];

```

--------------------------------

### Redeploy Magento Cloud Environment

Source: https://sansec.io/guides/grant-store-access

After adding Sansec's account to your Magento Cloud project, redeploy the production environment to activate the SSH key.

```bash
magento-cloud environment:redeploy production
```

--------------------------------

### Add SSH Public Key for Sansec Access

Source: https://sansec.io/guides/grant-store-access

Add Sansec's SSH public key to your authorized_keys file to enable secure access. Ensure the key is on a single line.

```bash
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSlrgyDEhQYmP1gihXTY/KlrDi6vUM+XlzEMlGSFglHhYRzmcB4l/LZgXDvfwXmvg+cr2wFRJJsq4G9H44qXkyVcn8h+f+rlWaMQNPlfqvdvQaFz/gJai/9hIf2WfmI5/zIF5uAzimTtz/ch9ur/23Qcic7dUeC4r6GASFFqR0Rt4zhCdOIdw2YU+5Jc2Xi7eWS3DD+Vko0j593CyMdn2iaQ1Vs2wivYvL57fd+lfNt+z2jOUOmkkOzcO4sVBZlVwVLrSYZIjHD6OcURA9j0ypwsneYAjNVBI+sjtnce/ZIncwyPSZ1oNTbImolwe1uK2zjjQSv1Gz4Z9lue1kS4LE4qba0+gnsGozbBPzAQ8v0aPr/uXDq96HCVUp8tPg/Evss3mA/AKvIKAduwVX+2Ia4h6W0jpQ103dncNF1ZdSBkbIi8NzIB+H3/nHkOfXa1jDXcudkmkXLwV1oClG4If6ZF6xet3Ao4KSgNsp6766rJPU3l9DZt86irTIMCjIRA0= sansec-gpg
```

--------------------------------

### Automatic Store Scan

Source: https://sansec.io/guides/usage

Run this command via SSH to automatically download and execute the eComscan script for an immediate store scan.

```bash
curl https://ecomscan.com | sh

```

--------------------------------

### Override Database Connection with DSN

Source: https://sansec.io/guides/advanced-scanning

Use the --force-dsn command line option to specify a custom database connection string (DSN). This is useful for dynamic database configurations or when enforcing a specific connection.

```bash
ecomscan --key=YOURKEY --force-dsn=$(wp-dsn /path/to/dynamic/wp-config.php) /path/to/wordpress
```

--------------------------------

### Check for Linux iconv RCE Vulnerability (CVE-2024-2961) using Precompiled Binary

Source: https://sansec.io/guides/iconv-glibc

This snippet downloads and executes a precompiled binary to check for the CVE-2024-2961 vulnerability. This is an alternative if `gcc` is not available on your production servers.

```bash
curl -sO https://sansec.io/downloads/linux-amd64/cve-2024-2961 &&
chmod 700 cve-2024-2961 &&
./cve-2024-2961

```

--------------------------------

### Perform Self-Update

Source: https://sansec.io/guides/integration

Execute this command to check for and apply newer eComscan binary releases. Recommended for performance and detection logic improvements.

```bash
/path/to/ecomscan --self-update 2>&1 >/dev/null
```
Tokens:
Raw