Linked Questions

50 votes
5 answers

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
user avatar
16 votes
5 answers

Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?

in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
nsog8sm43x's user avatar
6 votes
3 answers

Is it safe to connect to random SSH servers? [duplicate]

In a nutshell: How secure are SSH clients? Can servers mess with them? I saw this Ghost in the Shell bash remake today. Funny enough and there are a few movies (The Matrix, Star Wars, etc) that are ...
Oli's user avatar
  • 1,121
4 votes
2 answers

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
jamieweb's user avatar
  • 435
3 votes
2 answers

Is using cat -v an appropriate way to sanitize untrusted text?

It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an ...
forest's user avatar
  • 66.6k
2 votes
2 answers

Is it dangerous to receive mail as root?

In the default configuration for the postfix package on Arch Linux (and possibly elsewhere), the aliases file contains the following comment: ... # Person who should get root's mail. Don't receive ...
bcc32's user avatar
  • 121
1 vote
1 answer

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
barlop's user avatar
  • 129
0 votes
1 answer

Implications of running script as argument to shell

Context for the question is the following comment on one of my answers: @SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
Sergiy Kolodyazhnyy's user avatar
1 vote
0 answers

Does `cat -v` provide adequate protection against control character injection and other similar attacks? [duplicate]

I need to cat an untrusted file on a remote server. I'm doing this by logging in with SSH. There are known risks related to cat-ing untrusted files. See here. The cat -v option can be used to encode ...
rubberband876's user avatar
1 vote
0 answers

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
Dagelf's user avatar
  • 111