Skip to content
HackIndex logo

HackIndex

CGMS Input Handling Probing

4 min read Jan 19, 2026

CGMS is often a plaintext interactive TCP service. Input quirks tell you how strict the parser is, what delimiters matter, and whether malformed payloads trigger leaks or instability. The output differences here decide whether you move into deeper fuzzing or keep it purely as “command surface only”.

Delimiter and argument handling

Send valid commands with extra tokens and watch how it responds.

┌──(kali㉿kali)-[~]
└─$ printf "help test\r\n" | nc -nv -w 5 $TARGET_IP $PORT
┌──(kali㉿kali)-[~]
└─$ printf "version test\r\n" | nc -nv -w 5 $TARGET_IP $PORT

What changes your next move:

  • If it returns usage: or unknown argument style errors, you’ve got structured parsing and likely subcommands or flags worth enumerating.

  • If it ignores the extra token and runs the command anyway, you can be more aggressive with wordlist-based probing.

  • If it disconnects, treat the service as brittle and keep probes short and low volume.

Empty input and prompt behavior

Some implementations only answer after a newline, or they emit different prompts when idle.

┌──(kali㉿kali)-[~]
└─$ printf "\r\n" | nc -nv -w 5 $TARGET_IP $PORT

Signal to capture:

  • prompt changes

  • hidden banner lines

  • “invalid input” errors without any token

Newline and CRLF sensitivity

Some services are strict about line endings. Test LF and CRLF explicitly.

┌──(kali㉿kali)-[~]
└─$ printf "help\n" | nc -nv -w 5 $TARGET_IP $PORT
┌──(kali㉿kali)-[~]
└─$ printf "help\r\n" | nc -nv -w 5 $TARGET_IP $PORT

Interpretation:

  • If only CRLF works, keep using \r\n everywhere (wordlists, fuzzing, scripted loops).

  • If LF works but CRLF changes behavior, you’re likely hitting a different parser path. Keep both variants handy for later probes.

Echo and reflection checks

Send junk and see if the service reflects it back.

┌──(kali㉿kali)-[~]
└─$ printf "AAAA\r\n" | nc -nv -w 5 $TARGET_IP $PORT

What matters:

  • If your input is echoed verbatim, output parsing gets harder and later payload tests become more meaningful.

  • If it returns a structured error, mine it for expected syntax and tokenization hints.

Length limits and truncation

Start small to avoid crashing brittle services. Scale only if it stays stable.

┌──(kali㉿kali)-[~]
└─$ python3 -c "print('A'*200)" | tr -d '\n' | awk '{print $0 "\r\n"}' | nc -nv -w 5 $TARGET_IP $PORT

If 200 is stable, step up:

┌──(kali㉿kali)-[~]
└─$ python3 -c "print('A'*1000)" | tr -d '\n' | awk '{print $0 "\r\n"}' | nc -nv -w 5 $TARGET_IP $PORT

What to record:

  • truncation length (hard limit)

  • distinct error at a consistent boundary (buffer/validator limit)

  • disconnect or crash symptoms (candidate DoS or memory-safety bug path)

If you see crashes or repeated disconnects at a specific size, stop scaling and pivot to controlled fuzzing in a separate workflow.

Malformed input probes

These are quick signal checks for dangerous formatting or file/path handling code paths. Run them once, don’t loop them.

Format string markers

┌──(kali㉿kali)-[~]
└─$ printf "%%p %%x %%s\r\n" | nc -nv -w 5 $TARGET_IP $PORT

What changes your next move:

  • If you see hex-ish pointers, stack-ish values, or weird substitutions, treat it as a serious vuln lead and move to targeted fuzzing/exploit validation.

  • If it errors cleanly, it’s still useful: the error text often reveals internal function names or parsing stages.

Path-like payloads

┌──(kali㉿kali)-[~]
└─$ printf "../../../../\r\n" | nc -nv -w 5 $TARGET_IP $PORT

What to look for:

  • any mention of files, directories, “not found”, “permission”, “open failed”

  • changes in timing or response size compared to normal invalid tokens

If you see file-oriented errors, prioritize hunting for commands that accept filenames, config paths, exports, or logs.

Capture output for diffing

When responses are noisy or multi-line, log the session and diff results between payloads.

┌──(kali㉿kali)-[~]
└─$ ( printf "help\r\n"; printf "AAAA\r\n"; printf "%%p %%x %%s\r\n"; printf "../../../../\r\n" ) | nc -nv -w 5 $TARGET_IP $PORT | tee cgms_input_probe.log

References