3 ms·
> Because the use of "piping to a shell" can be detected server-side AFAIK, it’s not “piping to a shell” that can be detected, but the use of curl. That is tri
by Someone 3y ago
> Because the use of "piping to a shell" can be detected server-side
AFAIK, it’s not “piping to a shell” that can be detected, but the use of curl. That is trivial to do by looking at the user agent string. I don’t know whether it can also be done if that is spoofed using -A "user agent". Doing that makes that curl | sh command a lot less nice, though.
- jjgreen 3y agoIn fact one does not need the user-agent to detect curl | sh, details here https://web.archive.org/web/20230325190353/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20230325190353/https://www.idont... [original article has an expired cert]
- borplk 3y agoIt can be detected even without looking at the user agent (as another user mentioned). They typically rely on the fact that the downloaded source code is being executed as it is being downloaded so you can leave things like "sleep 5" and detect the delay in fetching from the client. The best thing to do is to download first and then execute. Also good installer scripts first define a function and then call the function at the very end of the script so that they don't half-execute some function in case the network connection is disrupted.