Dangerous
curl -k https://example.com/agent.sh | shcross-platform · bash · Beginner
Downloads a script over TLS with certificate verification turned off and pipes it into a shell. -k means anyone positioned on the network can substitute their own script and it will still run.
Signals to notice
- -k disables certificate verification, so the source is unauthenticated
- the response is piped directly into a shell
Think you can spot these under time pressure?
Start TrainingMore Shell
cat ~/.bashrcIntermediate:(){ :|:& };:Intermediateawk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | headExpertexport PATH="$HOME/.local/bin:$PATH"Expertfind ./logs -type f -name '*.log' -mtime +7 -print0 | xargs -0 -P 4 -I{} sh -c 'gzip -9 "$1"' _ {}Nightmareawk 'BEGIN{FS=","} NR>1 && $3 ~ /^2[0-9]{2}$/ {c[$2]++} END{for (k in c) printf "%-24s %6d\n", k, c[k]}' ./access.csv | sort -k2 -rn | head -20Nightmare