• Make a scanner for
  • Magento server - https://github.com/steverobbins/magescan
    • report server version
    • magento copyright year
    • check paths:
      • app/etc/local.xml
      • magento_version
      • downloader

https://github.com/joren485/Magento-Shoplift-SQLI

• update to python3
• confirm sqli vulnerable
• modify to avoid obvious poc values in the database

https://www.exploit-db.com/exploits/37811

• update to python3
• create a repl for command execution
• make a better tunnel callback mechanism
  • /bin/nc (not traditional)
  • /usr/bin/curl
  • /usr/bin/wget