Linked Questions
10 questions linked to/from Can "cat-ing" a file be a potential security risk?
1
vote
0
answers
60
views
How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]
Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
- 111
50
votes
5
answers
9k
views
Is using 'echo' to display attacker-controlled data on the terminal dangerous?
Imagine the following code:
ATTACKERDATA="$(cat attackerControlledFile.txt)"
echo "${ATTACKERDATA}"
An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
user163495
16
votes
5
answers
5k
views
Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?
in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
- 269
6
votes
3
answers
6k
views
Is it safe to connect to random SSH servers? [duplicate]
In a nutshell: How secure are SSH clients? Can servers mess with them?
I saw this Ghost in the Shell bash remake today. Funny enough and there are a few movies (The Matrix, Star Wars, etc) that are ...
- 1,121
1
vote
1
answer
568
views
Is nc -l unexploitable?
Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason.
I don't want it to be at risk of a buffer ...
- 129
4
votes
2
answers
558
views
Safely decrypting an unsolicited/untrusted PGP message
I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications.
Upon receiving an encrypted message, ...
- 435
3
votes
2
answers
910
views
Is using cat -v an appropriate way to sanitize untrusted text?
It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an ...
- 66.5k
2
votes
2
answers
304
views
Is it dangerous to receive mail as root?
In the default configuration for the postfix package on Arch Linux (and possibly elsewhere), the aliases file contains the following comment:
...
# Person who should get root's mail. Don't receive ...
- 121
0
votes
1
answer
116
views
Implications of running script as argument to shell
Context for the question is the following comment on one of my answers:
@SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
1
vote
0
answers
58
views
Does `cat -v` provide adequate protection against control character injection and other similar attacks? [duplicate]
I need to cat an untrusted file on a remote server. I'm doing this by logging in with SSH.
There are known risks related to cat-ing untrusted files. See here.
The cat -v option can be used to encode ...
- 193