3 ms·
made even worse by the fact that it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side. This means the atta
by chii 6mo ago
made even worse by the fact that it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side.
This means the attack can be "invisible", as a cursory glance at the output of the curl can be misleading.
You _have_ to curl with piping the output into a file (like | cat), and examine that file to detect any anomaly.
- boomlinde 6mo ago> it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side That sounded really interesting, so I looked it up and found this article from 2016 if anyone else is interested: https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://web.archive.org/web/20250622061208/https://www.idont...