4 ms·
How can you detect if the output is curl/piped?
by tpxl 10y ago
How can you detect if the output is curl/piped?
- Achshar 10y agoI would hazard a guess that curl won't send the standard request headers that browsers would.
- nemo1618 10y agoLike so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... To combat this sort of thing, @jbenet made hashpipe: https://jbenet.github.io/hashpipe https://jbenet.github.io/hashpipe
- scbrg 10y agohttps://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... Summary: Fill your script with an invisible payload that fills any buffers, and put something time consuming (say `sleep 5`) early in your script in order to detect that the script is being executed directly rather than just stored to disk. If the client halts before having read all data, it is likely a `curl | bash` scenario. If it just keeps reading, it's a regular browser just downloading.