cybersecurity · beginner · ~15 min · safe pentest lab

Detect terminal-escape injection

Flag control/escape bytes that let attacker-controlled log text hijack a terminal.

Challenge

Logs viewed with cat can be weaponized: ANSI escapes can hide or rewrite lines. Implement:

int has_control_escape(const char *s);

Return 1 if s contains ESC (0x1b), DEL (0x7f), or any C0 control byte (<0x20) other than TAB and newline; else 0.

Input format

A log-line string.

Output format

1 if a dangerous control byte is present, else 0.

Constraints

TAB (\t) and newline (\n) are allowed; carriage return and ESC are not.

Starter code

#include <stddef.h>
/* 1 if s contains a dangerous control byte: ESC(0x1b), DEL(0x7f), or any C0 control
   (< 0x20) other than TAB(\t) and newline(\n). */
int has_control_escape(const char *s){ (void)s; return 0; }

Common mistakes

Reading bytes as signed char (0x7f/high bytes mis-tested); allowing carriage return.

Edge cases to handle

A clean printable line -> 0; an embedded \x1b[2J -> 1.

Background lessons

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.