3 ms·
No. Totally possible to serve the "bad stuff" only some of the time. Browser exploit kits commonly will return different stuff depending on user agent, and wil
by ryan-c 11y ago
No. Totally possible to serve the "bad stuff" only some of the time.
Browser exploit kits commonly will return different stuff depending on user agent, and will track what IPs they have interacted with so that if after someone clicks the link you try to look at it, you'll get something harmless. Nasty business. The only way to be sure is to save it, inspect what you saved (make sure you use something that will show tricky escape sequences trying to hide things), then maybe run it.
- pyre 11y agoI'm not sure why you're taking about browser exploit kits when we're talking specifically about using curl or wget to pipe an HTTP payload into a shell.
- ryan-c 11y agoAll the same tricks could just as easily be applied to (wget|curl) pipe to shell scenarios.
- pyre 11y agoOk. Someone posed a scenario where an attacker uses the User-Agent to differentiate between a victim vetting the URL via a regular browser and someone using curl/wget to pipe it to the shell. I suggested a simple solution to this specific scenario. There are any number of scenarios where any given solution could be broken. Why not point out that you OS might be compromised and the wget/curl binary that you're using is patched to present the wrong information to you?