Questions tagged [terminal]
The terminal tag has no usage guidance.
40 questions
119
votes
7
answers
24k
views
Can "cat-ing" a file be a potential security risk?
I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've ...
- 2,199
90
votes
1
answer
12k
views
Mac OS X terminal prompt displaying foreign hostname (or: What is Stacey's iPhone doing in my Terminal?)
I opened my Terminal today and saw this:
StaceysiPhone6s:~ jcz$
Who is Stacey?
Why is she in my Terminal?
What happened?
What should I be worried about?
How do I fix it?
- 963
48
votes
2
answers
37k
views
How secure is "Secure Keyboard Entry" in Mac OS X's Terminal?
I've been using Terminal under Mac OS X for years but somehow missed to spot this feature:
I'm now wondering how does this actually work, and is it 100% safe? If it isn't, what technique could be ...
- 2,199
10
votes
3
answers
817
views
Simple way to safely paste text from website into terminal
It's fairly well known that it's very dangerous to copy-paste text from a website into a terminal, as it can include extra text, control codes, and newlines that aren't visible when you're copying it, ...
- 67.3k
9
votes
2
answers
7k
views
What exactly does `ssh -T user@domain verify` do?
The example I'm specifically thinking of is:
ssh -T [email protected] verify
Looking at the docs (man ssh) I can see that -T is the flag to "Disable pseudo-terminal allocation", but what implications ...
- 225
7
votes
3
answers
2k
views
Security implications of increasing sudo timeout in terminal
I often need to run commands with sudo during development and since my password is lengthy I don't like to type it every time sudo times out which by default is 5 minutes.
To deal with that I've run ...
- 259
6
votes
4
answers
1k
views
Why do GUI terminals allow the pasting of control characters?
Given that control characters are usually not rendered, but they are given a special meaning in most terminals, what reasons are there for terminal apps to continue to support copy-pasting of control ...
- 8,317
5
votes
1
answer
715
views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
- 187
5
votes
1
answer
6k
views
Using (cat $file; cat) to run a simple BOF exploit
Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF ...
- 133
4
votes
1
answer
2k
views
Is it possible to use the Linux "echo" command maliciously?
While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my ...
- 397
4
votes
2
answers
699
views
Safely decrypting an unsolicited/untrusted PGP message
I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications.
Upon receiving an encrypted message, ...
- 435
4
votes
3
answers
866
views
What would be a secure way to handle password prompts in shell?
I have a script that a member of our L1 team will run on a linux server (ssh'ed in - non root) that will take in their password and pass it to kinit via an embedded expect script (which ultimately ...
- 219
3
votes
4
answers
272
views
Why did "terminal commands" never get a version of SQL "parameterized queries"?
I was taught horrible bad practice when I initially "learned" SQL, which baked in user-submitted input with quotes and attempted to "escape" this (in the beginning, I didn't even ...
- 31
3
votes
2
answers
559
views
Good Practice to Secure Computer Terminal?
I am currently trying to set up a computer terminal from scratch at home. The use of it is basically as a terminal to connect to cloud servers hosted remotely in the internet.
I am trying my best to ...
- 131
3
votes
1
answer
249
views
Lightweight terminal protocol for IoT
For IoT devices with limited resources (e.g. embedded system with 32 kB RAM, 128 kB Flash memory, running an RTOS such as FreeRTOS, small TCP/IP stack such as lwIP):
It might be useful to have a ...
- 131
3
votes
2
answers
1k
views
Is using cat -v an appropriate way to sanitize untrusted text?
It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an ...
- 67.3k
3
votes
2
answers
395
views
how to secure terminal logs
There might be a misconception from my side on wether I should worry about this or not. But if I should, what measures should I take to secure my terminal logs / command history?
One of things ...
- 133
2
votes
2
answers
6k
views
Sign SSL certificate with root certificate using openssl
I have created a root certificate, My Root Certificate, with a private key, RSA Private Key 1, using the openssl terminal command.
I would like to make a certificate chain such as the following:
My ...
- 165
2
votes
2
answers
245
views
How to accept user input for use in terminal safely?
I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified.
// Get ...
- 1,404
2
votes
2
answers
505
views
PCI DSS 3.0 and card swipe terminals for our merchants
We run an online software service that collects and transmits card transactions for small merchants. They use card swipe terminals connected to their business PCs that direct the traffic straight ...
- 23
2
votes
1
answer
13k
views
How to get more information on TermDD Security Layer Disconnects (Event 56)
In my Admin event log, I see the following errors:
The Terminal Server security layer detected an error in the protocol
stream and has disconnected the client. Client IP: XXX.XXX.XXX.XXX
...
- 613
2
votes
0
answers
65
views
How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]
Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
- 121
1
vote
1
answer
251
views
Alternative forms for special characters in terminal
I was solving a problem on a popular hacking for fun website, when I got following idea:
Is it possible to represent - for example a '/' (just the slash) in the terminal (linux) in another way - for ...
- 13
1
vote
1
answer
299
views
Why Microsoft leaves known security flaws?
There is very well known security flaw in microsoft windows. That you simle boot a linux OS from flash drive e.g Kali Linux. And just replace a cmd file with sethc file and you can prompt cmd with ...
- 165
1
vote
1
answer
120
views
Does it make sense to check command integrity after running it as root?
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
- 2,267
1
vote
1
answer
311
views
Is there a way to ask cracklib-check to go through a list of passwords?
I know cracklib-check can be used to check individual password, like -
$ echo "12345" | /usr/sbin/cracklib-check
12345: it is too short
If not wanting to be super-user as on Debian it requires to ...
- 151
1
vote
1
answer
189
views
Repeated security questions after remote key has changed
I reinstalled one of my machines and gave it new ssh keys, which should yield warnings when I connect to it from a machine I have connected from earlier.
First I get the big warning that the remote ...
- 231
1
vote
0
answers
93
views
Is there such a thing as "parameterized terminal commands"?
Long ago, I used to do SQL queries like:
SELECT * FROM table WHERE id = ' . attempt_to_escape($_GET['id']) . ' ORDER BY timestamp DESC LIMIT 1;
This was horribly scary and I probably messed it up by ...
1
vote
0
answers
63
views
Does `cat -v` provide adequate protection against control character injection and other similar attacks? [duplicate]
I need to cat an untrusted file on a remote server. I'm doing this by logging in with SSH.
There are known risks related to cat-ing untrusted files. See here.
The cat -v option can be used to encode ...
- 193
1
vote
0
answers
230
views
What does it mean to "run a command in memory"? [closed]
If I open a terminal and use the following commands, are they "run in memory"?
$ curl -s http://website.com/file.py | python - &
$ command=$(curl -s http://website.com/file.py); $(echo $command |...
- 11
1
vote
0
answers
656
views
How to launch kali Linux installer inside live version
i need to know how I can launch the kali Linux installer through terminal pleas.
Running latest version of kali Linux on LIVE USB.
Trouble booting with uefi and so forth so I need to know how to ...
0
votes
1
answer
357
views
How secure is a serial/terminal/console server, from the serial side?
I'm upgrading my home lab, and one of the things I'm planning on introducing this time is out-of-band management through a Raspberry Pi console server similar to this: https://www.packet6.com/...
- 243
0
votes
1
answer
1k
views
Have I been hacked? Terminal shows me in a different hostname than my machine [duplicate]
Sorry for the generic title but really don't know how to call this.
I've just upgraded my MacBook Air to macOS Mojave 10.14.3.
Usually, when opening the terminal it would show something like ...
- 101
0
votes
1
answer
435
views
passing user input to command line
I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure.
The user enters a password, which is then ...
- 123
0
votes
0
answers
1k
views
Why my card changes from WPA Handshake to PMKID or vice versa just by airodump-ng
I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0.
Then i use airodump-ng wlan0 to capture ...
- 1
-1
votes
1
answer
155
views
OS X terminal starts from other device (got rooted?)
I've recently noticed that my terminal starts with something like "android... " even though I don't have any android device. Furthermore I noticed that my macbook only starts with "android..." when it'...
-2
votes
1
answer
291
views
Why are passwords in the Linux terminal unmasked? [closed]
When entering a password into the password field in a Linux terminal- the password is just in the clear!
This is a commonly known fact.
But what if I'm in public, like in an office, and need to enter ...
- 3,025
-2
votes
2
answers
787
views
Creating portable bash terminal & cmd to USB [closed]
Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any ...
-2
votes
1
answer
294
views
Security testing alternatives on MacOS [closed]
Is it possible/feasible to set up a hacking machine that rivals a distribution like Kali Linux on MacOS, or will it never be possible for MacOS to rival a distribution like Kali in terms of hacking ...
-2
votes
1
answer
1k
views
accessing Desktop from Root directory [closed]
I was using aircrack-ng package in my ubuntu 15.04. This package works only under root privileges. Now I want to save .cap file on my desktop using airodump-ng package but everytime I do, it throws an ...
- 7