3 ms·

Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or e

Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or even by detecting when you pipe it to bash[0] [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

marcthe12 7y ago
Well there is a way to resolve that. Have command in between curl and sh that effectively only prints to stdout once stdin receive EOF. A double tac is an xample
- mike_hock 7y ago
  Or, you know, pipe to a file and verify the content, then execute.