2 ms·
Your idea won't work and also would prevent most scripts in your system to work correctly. I wrote unix exploits for a living for years (All legit, in a pentes
by aortega 12y ago
Your idea won't work and also would prevent most scripts in your system to work correctly.
I wrote unix exploits for a living for years (All legit, in a pentest company) and for payloads I would normally use echo or printf to upload a binary and execute it. And those are built-in commands in the shell.
- lazyant 12y agoI know, still most of the script kiddy attacks I see (on a honeypot ssh for ex) are of the 'wget download bad script' type. I typically uninstall gcc and my scripts don't use wget/curl/scp, now rsync otoh... can't blacklist all possible tools, you may as well netfilter traffic to block non-root initiated traffic going out.