I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.
It’s nothing new or groundbreaking, but I figure it never hurts to have another reminder.
You must log in or # to comment.
I’m a bit lost with
a more cautious user might first paste the url into the address bar of their web browser to see what the script looks like before running it. In the
You… You just… You just dump the curl output to file and examine that and then run it if its good
Just a weird imagined sequence to me.
Worse than that, the server can change it’s response based on user agent so you need to curl it to a file first, a browser could be served a completely different response.
you’d have to be mad to willingly pipe a script to bash without checking it. holy shit
I mean, true, but most of the things I do that with are private scripts that I wrote. I think the main exception to that is Oh-my-zsh.
Also it’s not really a full pipe…
bash <(curl cht.sh/curl)That’s saves the URL as a temporary file and opens it with bash. Frankly, the URL I gave you is very bad because it is not actually a script, just the help page for curl. Frankly, it would better if it wasn’t nested.
