Five things about SAP hybris you probably didn’t know

Invisible Number Sign

If you try to use the hash symbol in the input fields, with XSS on, the server will receive the truncated value, with this symbol removed.

Untitled 4_.png

It is so because of the default XSS rule settings (project.properties):

yacceleratorstorefront.xss.filter.rule.javascript2=(?i)\\u0023
yacceleratorstorefront.xss.filter.rule.braces=(?i)<(.*?)>

please ensure that it is <2 and >3” will be transformed to “please ensure that it is 3” after the second rule is applied. It is also on by default.

This filtering will work for all kind of fields, both regular and password fields. It means that if your password is “abc_123”, the following passwords will also work with authentication: “ab#c_123”, “abc####123″, “abc#########123″ etc.

In order to use this sign in the configuration files, use backslashes:

property.value=hybris\\#value

Salt with pepper

Hybris uses “hybris blue pepper can be used to prepare delicious noodle meals” as a default salt for password (md5)

Untitled 4_1.png

How Ronald Reagan becomes the President of Russia in Hybris tests

In de.hybris.platform.directpersistence.audit.impl.SaveAuditRecordsTest, a user named Ronald Reagan, described as the President of the United States, becomes the President of Russia. And removed after the transaction triply committed that makes the test happy. In the same class, the user named Margaret Thatcher comes into play as well.

Screen Shot 2018-04-15 at 12.50.40 PM.png

HAC Easter Egg

I was waiting months for this year’s Easter to write about this. If you use HAC intensively, you are aware of it, but you likely don’t know how to turn it on once it is launched.

If you press “J” and “ESC” in any order, your HAC will go crazy:

If you haven’t saved your script in the form and want to restore the data, reloading the page is not a solution. There is a way how to fix it without reloading the page. Open the web console and type the following:

for (i=0;i<document.styleSheets[0].cssRules.length;i++) { if (document.styleSheets[0].cssRules[i].cssText.indexOf("transform")>0) { document.styleSheets[0].deleteRule(i); } }

It should help. In the latest version, this easter egg was removed.

Is the website built with Hybris?

In order to figure out whether the website is built with SAP hybris, just follow the link  http://DOMAIN/CONTEXT/view/NavigationBarComponentController. The context may be empty (it is so for the majority of hybris websites). For example,

https://www.hybris.com/en/view/NavigationBarComponentController

Untitled 4

Actually, you can use any controller name, but this one is OOTB and should be on for all hybris projects.

If you see the response above and the normal 404 page looks different, the storefront is built with SAP hybris. But vice versa is not true: SAP hybris can be too deep and too customized to be revealed via this approach. However, it works for the majority of the websites.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: