4 ms·
All the same tricks could just as easily be applied to (wget|curl) pipe to shell scenarios.
by ryan-c 11y ago
All the same tricks could just as easily be applied to (wget|curl) pipe to shell scenarios.
- pyre 11y agoOk. Someone posed a scenario where an attacker uses the User-Agent to differentiate between a victim vetting the URL via a regular browser and someone using curl/wget to pipe it to the shell. I suggested a simple solution to this specific scenario. There are any number of scenarios where any given solution could be broken. Why not point out that you OS might be compromised and the wget/curl binary that you're using is patched to present the wrong information to you?