On Tue, Feb 06, 2018 at 01:47:50PM +0100, Daniel Stenberg wrote: > But in the context of "dangerous things", how do see the user + password in > the URL used to harm the application or the server?
If the application/script sets --netrc then an attacker would just need to supply a username and curl would fill in the password, allowing attacks on machines that honoured those credentials (probably only local machines). And if --negotiate or --ntlm are enabled, then the attacker may not even need to supply a username to attack a local machine, as the request could be automatically authenticated as the local user. >>> Dan ------------------------------------------------------------------- Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library Etiquette: https://curl.haxx.se/mail/etiquette.html
