# CGMS Input Handling Probing

- **URL:** https://hackindex.io/services/cgms/enumeration/cgms-input-handling-probing
- **Path:** CGMS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/cgms/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-01-19

## CGMS Input Handling

CGMS is often a plaintext interactive TCP service. Input quirks tell you how strict the parser is, what delimiters matter, and whether malformed payloads trigger leaks or instability. The output differences here decide whether you move into deeper fuzzing or keep it purely as “command surface only”.

## Delimiter and argument handling

Send valid commands with extra tokens and watch how it responds.

```bash
printf "help test\r\n"    | nc -nv -w 5 $TARGET_IP $PORT
printf "version test\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

What changes your next move:

- If it returns `usage:` or `unknown argument` style errors, you’ve got structured parsing and likely subcommands or flags worth enumerating.
- If it ignores the extra token and runs the command anyway, you can be more aggressive with wordlist-based probing.
- If it disconnects, treat the service as brittle and keep probes short and low volume.

## Empty input and prompt behavior

Some implementations only answer after a newline, or they emit different prompts when idle.

```bash
printf "\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

Signal to capture:

- prompt changes
- hidden banner lines
- “invalid input” errors without any token

## Newline and CRLF sensitivity

Some services are strict about line endings. Test LF and CRLF explicitly.

```bash
printf "help\n"   | nc -nv -w 5 $TARGET_IP $PORT
printf "help\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

Interpretation:

- If only CRLF works, keep using `\r\n` everywhere (wordlists, fuzzing, scripted loops).
- If LF works but CRLF changes behavior, you’re likely hitting a different parser path. Keep both variants handy for later probes.

## Echo and reflection checks

Send junk and see if the service reflects it back.

```bash
printf "AAAA\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

What matters:

- If your input is echoed verbatim, output parsing gets harder and later payload tests become more meaningful.
- If it returns a structured error, mine it for expected syntax and tokenization hints.

## Length limits and truncation

Start small to avoid crashing brittle services. Scale only if it stays stable.

```bash
python3 -c "print('A'*200)" | tr -d '\n' | awk '{print $0 "\r\n"}' | nc -nv -w 5 $TARGET_IP $PORT
```

If 200 is stable, step up:

```bash
python3 -c "print('A'*1000)" | tr -d '\n' | awk '{print $0 "\r\n"}' | nc -nv -w 5 $TARGET_IP $PORT
```

What to record:

- truncation length (hard limit)
- distinct error at a consistent boundary (buffer/validator limit)
- disconnect or crash symptoms (candidate DoS or memory-safety bug path)

If you see crashes or repeated disconnects at a specific size, stop scaling and pivot to controlled fuzzing in a separate workflow.

## Malformed input probes

These are quick signal checks for dangerous formatting or file/path handling code paths. Run them once, don’t loop them.

### Format string markers

```bash
printf "%%p %%x %%s\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

What changes your next move:

- If you see hex-ish pointers, stack-ish values, or weird substitutions, treat it as a serious vuln lead and move to targeted fuzzing/exploit validation.
- If it errors cleanly, it’s still useful: the error text often reveals internal function names or parsing stages.

### Path-like payloads

```bash
printf "../../../../\r\n" | nc -nv -w 5 $TARGET_IP $PORT
```

What to look for:

- any mention of files, directories, “not found”, “permission”, “open failed”
- changes in timing or response size compared to normal invalid tokens

If you see file-oriented errors, prioritize hunting for commands that accept filenames, config paths, exports, or logs.

## Capture output for diffing

When responses are noisy or multi-line, log the session and diff results between payloads.

```bash
( printf "help\r\n"; printf "AAAA\r\n"; printf "%%p %%x %%s\r\n"; printf "../../../../\r\n" ) | nc -nv -w 5 $TARGET_IP $PORT | tee cgms_input_probe.log
```

## References

- [nc(1) manual](https://man.openbsd.org/nc.1) - Netcat flags for TCP connects and timeouts