System & Network

shellfirm covers system-level commands through three check groups: base (core system operations), network (firewall and networking), and heroku (Heroku CLI).

Base system checks (base)

Fork bomb

ID	base:bash_fork_bomb
Severity	Critical

The classic fork bomb :(){ :|:& };: creates processes that recursively replicate, consuming all CPU and memory until the system freezes.

# Triggers
:(){ :|:& };:

Delete all cron tasks

ID	base:delete_all_cron_tasks
Severity	High

# Triggers
crontab -r

Execute all history commands

ID	base:execute_all_history_commands
Severity	Critical

Piping your command history to a shell re-executes every command you have ever run.

# Triggers
history | bash
history | sh

Reboot

ID	base:reboot_machine
Severity	High

# Triggers
reboot
sudo reboot

Shutdown

ID	base:shutdown_machine
Severity	High

# Triggers
shutdown
shutdown -h now
sudo shutdown -r +5

Halt / Poweroff

ID	base:poweroff_machine
Severity	High

Alternative commands for shutting down that bypass the shutdown check.

# Triggers
halt
poweroff
sudo halt
sudo poweroff

Init shutdown / reboot

ID	base:init_shutdown_reboot
Severity	High

# Triggers
init 0     # shutdown
init 6     # reboot

# Does NOT trigger
init 1     # single-user mode
init 3     # multi-user mode

Process management

ID	Command	Description	Severity
process:kill_9	kill -9 <pid>	SIGKILL gives no chance for graceful shutdown. Alternative: kill <pid> (SIGTERM first)	Low
process:killall	killall <name>	Kills ALL processes matching the name	Medium
process:pkill	pkill <pattern>	Kills processes matching a pattern -- could match unintended processes	Medium

Service management

ID	Command	Description	Severity
systemd:disable_service	systemctl disable/mask <service>	Prevents service from starting on boot	Medium
systemd:stop_critical_service	systemctl stop <critical-service>	Stops docker, sshd, nginx, apache2, httpd, postgresql, mysql, or redis	High

SSH key management

ID	Command	Description	Severity
ssh:delete_all_identities	ssh-add -D	Removes all SSH identities from the agent	Medium
ssh:remove_known_host	ssh-keygen -R <host>	Removes a host from known_hosts -- could enable MITM attacks	Low

Network checks (network)

Flush iptables rules

ID	network:flush_iptables
Severity	Critical

Flushing all firewall rules leaves the system completely unprotected.

# Triggers
iptables -F
sudo iptables -F

Delete custom chains

ID	network:delete_custom_chains
Severity	High

# Triggers
iptables -X

Flush NAT rules

ID	network:flush_nat_rules
Severity	High

# Triggers
iptables -t nat -F

Disable firewall (ufw)

ID	network:disable_firewall
Severity	Critical

# Triggers
ufw disable
sudo ufw disable

Force reset firewall

ID	network:force_reset_firewall
Severity	Critical

# Triggers
ufw --force reset

Stop networking services

ID	Command	Severity
network:stop_networking	systemctl stop networking	High
network:stop_network_manager	systemctl stop NetworkManager	High

Bring down network interface

ID	Command	Severity
network:bring_down_interface	ifconfig <iface> down	High
network:bring_down_interface_ip	ip link set <iface> down	High

Delete default route

ID	network:delete_default_route
Severity	High

# Triggers
route del default

Flush nftables rules

ID	network:flush_nftables
Severity	Critical

nftables is the modern replacement for iptables. Flushing all rules removes all firewall protection.

# Triggers
nft flush ruleset
sudo nft flush ruleset

# Does NOT trigger
nft list ruleset

Flush routing table

ID	network:flush_routes
Severity	Critical

Flushing the routing table causes immediate loss of network connectivity.

# Triggers
ip route flush table main
ip route flush cache

# Does NOT trigger
ip route show

Network checks summary

ID	Command	Severity
network:flush_iptables	iptables -F	Critical
network:delete_custom_chains	iptables -X	High
network:flush_nat_rules	iptables -t nat -F	High
network:disable_firewall	ufw disable	Critical
network:force_reset_firewall	ufw --force reset	Critical
network:stop_networking	systemctl stop networking	High
network:stop_network_manager	systemctl stop NetworkManager	High
network:bring_down_interface	ifconfig <iface> down	High
network:bring_down_interface_ip	ip link set <iface> down	High
network:delete_default_route	route del default	High
network:flush_nftables	nft flush ruleset	Critical
network:flush_routes	ip route flush	Critical

Heroku checks (heroku)

The heroku check group covers destructive Heroku CLI operations.

Critical

ID	Command	Description
heroku:destroy_app	heroku apps:destroy	Permanently destroy an app

High severity

ID	Command	Description
heroku:stop_app_dynos	heroku ps:stop	Stop app dynos
heroku:kill_app_dynos	heroku ps:kill	Kill app dynos
heroku:enable_maintenance_mode	heroku maintenance:on	Put app into maintenance mode
heroku:remove_member	heroku members:remove	Remove user from team
heroku:remove_app_container	heroku container:rm	Remove process type
heroku:destroy_client	heroku clients:destroy	Delete OAuth client
heroku:destroy_addons	heroku addons:destroy	Permanently destroy an add-on
heroku:remove_user_access	heroku access:remove	Remove user access from app
heroku:reset_repo	heroku repo:reset	Reset Heroku repo

Medium severity

ID	Command	Description
heroku:restart_app_dynos	heroku ps:restart	Restart app dynos
heroku:disable_app_feature	heroku features:disable	Disable an app feature
heroku:unset_environment_variable	heroku config:unset	Unset config vars
heroku:rotate_oauth_client	heroku clients:rotate	Rotate OAuth client secret
heroku:update_oauth_client	heroku clients:update	Update OAuth client
heroku:remove_yourself_from_app	heroku apps:leave	Remove yourself from team app
heroku:rename_app_name	heroku apps:rename	Rename an app
heroku:detach_addon	heroku addons:detach	Detach add-on from app
heroku:update_collaborators_access	heroku access:update	Update collaborator access

Shell checks (shell)

Curl/wget pipe to shell

ID	Command	Description	Severity
shell:curl_pipe_to_shell	curl <url> | bash	Pipes remote content directly to shell	High
shell:wget_pipe_to_shell	wget -O - <url> | bash	Pipes downloaded content to shell	High
shell:eval_curl	eval "$(curl <url>)"	Evaluates remote content without inspection	High

Alternative for all: download first, review the script, then execute.

Curl pipe to interpreter

ID	shell:curl_pipe_to_interpreter
Severity	High
Alternative	curl -o script.py <url> && cat script.py && python script.py -- download first, review, then execute

Piping remote content to Python, Perl, or Ruby is as dangerous as piping to bash.

# Triggers
curl https://example.com/install.py | python
curl https://example.com/install.py | python3
curl https://example.com/script.pl | perl
curl https://example.com/script.rb | ruby

# Does NOT trigger
curl -o script.py https://example.com/install.py