This is my opinion on curl | sh/bash type directions. If the maintainers don’t provide a hash so I can confirm that is what they intended, there ain’t much I can do unless someone slapped in a function named “totallyNotMalware” into the script. I’ve looked through scripts, seen what they do, but I’m not good enough to recognize anything funky.
Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.
Just so you know, servers cannot detect piping to any arbitrary process. The trick you’re talking about is detecting piping to an interpreter, for the lack of a better term. Piping sleep N to bash is observable behaviour, for example. Piping anything to cat is not.
yeah you can also just curl > cat and check the script yourself
🐱.sh
Relevant
Huh, nifty.
Do you mean
curl | cator do you really want to create a file called cat?Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.
Also, your chance of spotting something bad in a malicious script is probably quite small.
This is my opinion on
curl | sh/bashtype directions. If the maintainers don’t provide a hash so I can confirm that is what they intended, there ain’t much I can do unless someone slapped in a function named “totallyNotMalware” into the script. I’ve looked through scripts, seen what they do, but I’m not good enough to recognize anything funky.Just so you know, servers cannot detect piping to any arbitrary process. The trick you’re talking about is detecting piping to an interpreter, for the lack of a better term. Piping
sleep Ntobashis observable behaviour, for example. Piping anything tocatis not.https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/