On Tue, Feb 06, 2018 at 01:47:50PM +0100, Daniel Stenberg wrote:
> But in the context of "dangerous things", how do see the user + password in
> the URL used to harm the application or the server?

If the application/script sets --netrc then an attacker would just need to
supply a username and curl would fill in the password, allowing attacks on
machines that honoured those credentials (probably only local machines). And if
--negotiate or --ntlm are enabled, then the attacker may not even need to
supply a username to attack a local machine, as the request could be
automatically authenticated as the local user.

>>> Dan
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2018-02-07