Linux Vulns
Last updated
Last updated
Wildcard Injection is an attack that exploits the use of wildcards (*, ?, []) in Linux commands to execute malicious code. This is possible when a user runs commands like tar, rsync, or scp in directories where an attacker has created files with names that resemble command-line options. This can lead to the unintended execution of commands without the user noticing.
An attacker can exploit Wildcard Injection by creating malicious files in a directory where the victim will execute a command using *. For example, they can use:
When the victim runs a command like tar -cf backup.tar *, tar will interpret the filenames as options and execute the code, starting a reverse shell to the attacker.
