Hot answers tagged

97

SNI hole You've fallen into a "SNI hole". Google will present a different certificate if there is no "Server Name Indication" given in the client's TLS handshake part. OpenSSL will not set this automatically. You have to do it manually. But all modern web clients, including CURL, should do this automatically. Hence the difference. Using SNI with OpenSSL ...


73

Regarding the connection there's no difference: the TLS is negotiated first and the HTTP request is secured by the TLS. Locally this might be less secure, because: The password gets saved to the command history (~/.bash_history) as a part of the command. Note: This can be avoided by adding a space in front of the command before running it (provided you ...


39

It it's about as safe as any other standard1 installation method as long as you: Use HTTPS (and reject certificate errors) Are confident in your certificate trust store Trust the server you're downloading from You can, and should, separate the steps out -- download the script2, inspect it, and see if it's doing anything fishy before running the script you ...


32

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


17

There are three major security features you'd want to look at when comparing curl ... | bash installation to a Unix distribution packaging system like apt or yum. The first is ensuring that you are requesting the correct file(s). Apt does this by keeping its own mapping of package names to more complex URLs; the OCaml package manager is just opam offering ...


14

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


13

If the input is not carefully filtered, then that is a vulnerability called Server Side Request Forgery (SSRF). There is even a common weakness enumeration number and page for it. https://cwe.mitre.org/data/definitions/918.html By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly ...


10

You are entering a URL with / in it rather than a hostname, and the tools you're using are treating that as a CIDR address (and then failing to parse it). Compare the following (wrong way, right way): $ nmap http://www.example.com/ Starting Nmap 6.40 ( http://nmap.org ) at 2016-08-11 10:10 EDT Unable to split netmask from target expression: "http://www....


9

Well depending on how they've implemented this feature it could indeed be quite dangerous. In addition to to the risks you've mentioned there's also the potential for non-public URLs to be retrieved by the system. For example retrieving http://127.0.0.1 would retrieve localhost. This can be a risk as things like administration panels are commonly deployed ...


7

--socks5 will use the SOCKS5 protocol for the HTTP connections but the name lookup will still be done using the normal DNS which means that your public IP address can be seen by the external name server you use. To do name lookup through the proxy too you need to use --socks5-hostname option. From the documentation of curl --socks5 Use the ...


7

But is this method less secure? No, it is not if you use https. When you use HTTPS your complete transaction will be encrypted. But as @Esa mentioned it is insecure locally which you can avoid adding a space before your command so that the command will not be in your command history. If you are worried about exposing the command on the other users ps than ...


6

If this library is set in root mode (but local user can execute), can someone write a C program to elevate the privileges to root? I'm assuming that you mean that the library is owned by root and can only modified by root but that a non-privileged user can use this library inside its own program. It actually does not matter who owns a library as long as ...


5

Is it safe? Not completely; just because you're fetching safe code now doesn't mean that link will always point to safe code, and many command-line tools don't verify certificates, which could lead to a MITM attack. Is it safe enough? Yeah, for most use cases, probably. The attack scenario is pretty rare, and an attacker who is positioned to pull it off can ...


5

Theory is: cURL should validate the server's certificate (and it claims to do it). Validation is a complex process (see section 6 of RFC 5280 if you do not value much your sanity) but the gist of it is that, given some a priori trusted keys (that's cURL's "CA cert bundle"), it can verify that the certificate sent by the server has been more or less directly ...


5

All modern browser support SNI and use it by default (there is probably not even a away to switch it off). Current versions of most tools like curl use SNI too by default, but not all. For example with openssl s_client you explicitly need to specify -servername ...if you want to use SNI and in some programming languages SNI is only used by default if you use ...


4

Storing credentials in clear-text on your computer is a risky business as any application that runs on your computer has access to these credentials. The credentials are also exposed in backups, zips, etc... .netrc files are a prime target for attackers looking to branch out to other computers.


4

The SSL protocol involves a handshake where the version is negotiated. The web server and the client will agree on the newest version that they both support. As cURL supports TLS 1.2, the newest standardized version, the version of TLS chosen will correspond to the highest version that the server supports unless you restrict cURL's SSL options. Googling SSL ...


4

SSRF could only be mitigated with a (regularly updated) white list of hosts or URL's which are known to be safe, i.e. which don't have any side effects which depend on the source IP and where access to a URL will not cause an abuse report, law suite or similar against your site (for example because someone tries to find hidden pages on a site or making bomb ...


4

I think you are misunderstanding how an CSRF-attack works, and why CSRF-tokens protects against them. So lets begin with how one works. The attacker fools the victim to visit http://evil.com that contains a form that automatically does a POST to http://bank.com/transfer?to=evilHacker&amount=1000000. If the victim is already logged in to her bank, the ...


4

Most browsers have developer tools which allow you to monitor all HTTP(S) requests sent by the browser, including an option to copy the requests as a cURL command. If you execute the request via cURL, it's indistinguishable from a 'real' browser request. Therefore, that is certainly not a crime. If you're looping cURL requests, you're essentially trying to ...


4

Submitting an answer to my own question. Not sure if this is the best answer, but I'm hoping other answers will address these points. curl {something} | sudo bash - on Linux is equally safe as downloading something on Windows and right-clicking run as administrator. One can argue that this is 'reasonably safe', but as a recent xkcd suggests, nobody really ...


4

"Reasonably Safe" depends on your goalposts, but curl | bash is well behind state-of-the-art. Let's take a look at the kind of verification one might want: Ensuring that someone malicious at your ISP can't do a man-in-the-middle to feed you arbitrary code. Ensuring that you're getting the same binaries the author published Ensuring you're getting the same ...


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


3

if cURL is configured to follow redirects, the redirect must be validated the same way as the original IP, since forging a redirect is trivial Yes. You'd be best off not getting curl to follow redirects and instead manually check the Location header when a redirect is encountered. IPv6: Everything for the nice old IPv4 address space must be redone ...


3

To add to what Steffen said, and provide some examples, you want to do a whitelist if at all possible. Blacklisting, like what you are proposing, can be bypassed. For example: http://2915201827/ - This is a valid website. Do you know which website it is? Also, the tool as described is a proxy. Without throttling, someone could use this tool to perform ...


3

Yes, there are security implications. You've completely turned off certificate validation, you'll accept invalid certs. You've opened yourself to MitM attacks, and you might as well transmit over http, because you dropped all the security goodies of https. You should look into why your server doesn't accept let's encrypt certificates (I'm assuming that's ...


3

There is no such thing as a "TLS header line". "17 03 03" in your output just means the beginning of a new TLS frame with application data (type 23, i.e. 0x17, followed by TLS protocol where 0x0303 means TLS 1.2). The output you show instead means that one client is sending the POST header and body within a single TLS frame while the other client is ...


3

I would go the exact opposite way. Put the code on github, let people fork it, send pull requests, change the code. It evolves. If you made a critical mistake, someone will notice and inform you. And use TLS. There's a great community behind it, there are bugs, but they are so obscure most of the time that we mere mortals don't need to be worried. ...


3

I would suggest that there is some firewall doing deep packet inspection. The TCP handshake is forwarded to the original target but the firewall is watching the connection. It then sees the HTTP request with the Host header and checks the value of the header against the policy. If the site is forbidden according to the policy the firewall will itself reply ...


3

I am not a lawyer, and the world is a large place with many conflicting laws, so I can't say anything about the legality of using cURL... But from a technical standpoint, anything that you can do to their server with cURL, you can also do with a web browser. Anything that you can do to their server with a web browser, you can also do with cURL. They are ...


Only top voted, non community-wiki answers of a minimum length are eligible