Linked Questions

50 votes
5 answers
9k views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
user avatar
16 votes
5 answers
5k views

Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?

in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
nsog8sm43x's user avatar
6 votes
3 answers
6k views

Is it safe to connect to random SSH servers? [duplicate]

In a nutshell: How secure are SSH clients? Can servers mess with them? I saw this Ghost in the Shell bash remake today. Funny enough and there are a few movies (The Matrix, Star Wars, etc) that are ...
Oli's user avatar
  • 1,121
4 votes
2 answers
587 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
jamieweb's user avatar
  • 435
3 votes
2 answers
962 views

Is using cat -v an appropriate way to sanitize untrusted text?

It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an ...
forest's user avatar
  • 66.6k
2 votes
2 answers
317 views

Is it dangerous to receive mail as root?

In the default configuration for the postfix package on Arch Linux (and possibly elsewhere), the aliases file contains the following comment: ... # Person who should get root's mail. Don't receive ...
bcc32's user avatar
  • 121
1 vote
1 answer
575 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
barlop's user avatar
  • 129
0 votes
1 answer
126 views

Implications of running script as argument to shell

Context for the question is the following comment on one of my answers: @SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
Sergiy Kolodyazhnyy's user avatar
1 vote
0 answers
58 views

Does `cat -v` provide adequate protection against control character injection and other similar attacks? [duplicate]

I need to cat an untrusted file on a remote server. I'm doing this by logging in with SSH. There are known risks related to cat-ing untrusted files. See here. The cat -v option can be used to encode ...
rubberband876's user avatar
1 vote
0 answers
60 views

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
Dagelf's user avatar
  • 111