Understanding Command Injection with eval

Another major problem with shell script security involves scripts that accept input from untrusted users or untrusted sources. If the script is coded incorrectly, an attacker could use it to inject malicious commands as the script’s input. Before we look at examples of that, let’s look the eval command, which facilitates passing data or commands into a script.

Using eval on the Command-line

The eval command is a shell builtin that’s available on most shells. It’s very handy when used properly, but dangerous when used improperly. Before we get into that, let’s look at how eval works on the command-line.

Okay, eval is one of those commands that can be really complex to fully understand. So, to keep things simple, I’ll be presenting some rather simplistic eval demos in this section. Even though they’ll demonstrate things that you’ll never do in real life, they’ll...