As the warning message you got, the website you visited is likely to perform a drive-by download attack that does not require necessarily the user's interaction with the webpage.
But using lynx
command will NOT lead you to be a victim of such attacks because all types of drive-by download attacks succeed only by either exploiting, via malicious crafted JavaScript code with which lynx
has no business, the vulnerabilities that your website may have or the ones that the browser extensions you installed may suffer from.
However, lynx
may be vulnerable to other vulnerabilities just as similar command lines:
wget
1.15 (leaks memory of earlier connections and own state)
curl
7.36.0 (https, FTP/IMAP/POP3/SMTP with --ftp-ssl)
Note that prior lynx versions to 2.8.5dev9 did not check at all for certificate validity (not supporting SSL) and depending on the version you are running, it may be prone to errors that an attacker may be could exploit.
In addition to this, lynx command is known to be vulnerable to other types of attacks. For instance, versions 2.8.4rel.1, 2.8.5dev.8, 2.8.3rel.1 and 2.8.2rel.1 are vulnerable to CRLF injection allowing an attacker to add other HTTP headers when the victim views a webpage using this command.
You also need to check if your lynx version is not vulnerable to know attacks:
- CVE-2008-4690: arbitrary code execution
- CVE-2006-7234: arbitrary code execution
- CVE-2010-2810: arbitrary code execution, DoS and Heap-based buffer overflow
- CVE-2012-5821: man-in the middle attack to spoof SSL serers