InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more

Menu
  • Home
  • Sitemap

Python Programming Language Best Tutorials and Code Examples

Learn Python Right Now!
Home
Bash
Leaking Passwords into the Process List in bash
Bash

Leaking Passwords into the Process List in bash

InfinityCoder February 28, 2017

ps may show passwords entered on the command line in the clear.

For example:

1
2
3
4
5
6
7
8
$ ./cheesy_app -u user -p password &
[1] 13301
 
$ ps
  PID TT STAT TIME COMMAND
5280 p0 S 0:00.08 -bash
9784 p0 R+ 0:00.00 ps
13301 p0 S 0:00.01 /bin/sh ./cheesy_app -u user -p password

Try really hard not to use passwords on the command line.

Really. Don’t do that.
Many applications that provide a -p or similar switch will also prompt you if a password required and you do not provide it on the command line.

That’s great for interactive use, but not so great in scripts.

You may be tempted to write a trivial “wrapper” script or an alias to try and encapsulate the password on the command line.

Unfortunately, that won’t work since the command is eventually run and so ends up in the process list anyway.

If the command can accept the password on STDIN, you may be able to pass it in that way.

That creates other problems, but at least avoids displaying the password in the process list.

1
$ ./bad_app ~.hidden/bad_apps_password

If that won’t work, you’ll need to either find a new app, patch the one you are using, or just live with it.

Share
Tweet
Email
Prev Article
Next Article

Related Articles

Writing Output to the Terminal/Window in bash
You want some simple output from your shell commands. Use …

Writing Output to the Terminal/Window in bash

Avoiding Aliases, Functions in bash
You’ve written an alias or function to override a real …

Avoiding Aliases, Functions in bash

About The Author

InfinityCoder
InfinityCoder

Leave a Reply

Cancel reply

Recent Tutorials InfinityQuest

  • Adding New Features to bash Using Loadable Built-ins in bash
    Adding New Features to bash Using Loadable …
    June 27, 2017 0
  • Getting to the Bottom of Things in bash
    Getting to the Bottom of Things in …
    June 27, 2017 0

Recent Comments

  • fer on Turning a Dictionary into XML in Python
  • mahesh on Turning a Dictionary into XML in Python

Categories

  • Bash
  • PHP
  • Python
  • Uncategorized

InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more

About Us

Start learning your desired programming language with InfinityQuest.com.

On our website you can access any tutorial that you want with video and code examples.

We are very happy and honored that InfinityQuest.com has been listed as a recommended learning website for students.

Popular Tags

binary data python CIDR convert string into datetime python create xml from dict python dictionary into xml python how to create xml with dict in Python how to write binary data in Python IP Address read binary data python tutorial string as date object python string to datetime python

Archives

  • June 2017
  • April 2017
  • February 2017
  • January 2017
  • December 2016
  • November 2016
Copyright © 2021 InfinityQuest - Programming Code Tutorials and Examples with Python, C++, Java, PHP, C#, JavaScript, Swift and more
Programming Tutorials | Sitemap