3 ms·
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh http://example.com/script.sh | sh' or something,
by henrikschroder 10y ago
I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does.
...which of course is so much work that noone does it.
- notriddle 10y agoOr open it in an actual text editor, like I do anyway to get syntax highlighting.
- stable-point 10y agoOpening it in a text editor is not sufficient. With clever use of 'sleep' you can even have the server return a malicious payload only if it thinks its getting immediately piped to sh[0]. If you're opening it in a browser to check, you've also got to worry that the server may be looking at curl's user agent to decide whether to serve up a malicious payload[1]. [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [1] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...