Test Shellshock only through a confirmed CGI-to-Bash chain
Needs: HTTP-derived environment data reaches an affected Bash process and the selected command is available
Shell commands
# Baseline
# Bounded command-effect probe at the actual CGI script
curl -i -H 'User-Agent: () { :;}; echo; /usr/bin/id' \
http://TARGET:PORT/cgi-bin/SCRIPT
Read: an attributable UID in the executed CGI response supports the effect; reflection of the header text does not. Header/CGI parsing errors require inspecting the request and script behavior. No effect → re-check the actual component and patch status before selecting another PoC. This is the CVE-2014-6271 family, not a generic command separator for every web input.
Verify → Require command-derived output distinct from reflected header text and record the CGI identity.
If it fails → No effect can mean patched Bash, non-Bash CGI, header sanitization or wrong endpoint; re-check the component before another payload. More detail ↓
Explanation & examples
Test Shellshock only through a confirmed CGI-to-Bash chain
- USE WHEN
- A real CGI endpoint invokes Bash and component/patch evidence supports the vulnerable family
- STARTING ACCESS
- A reproducible application request and a controlled input or access-context comparison
- RESULT
- A verified command effect under the CGI process identity
Recognize the clue
Confirm a CGI endpoint, Bash invocation and vulnerable component evidence before sending one bounded header probe.
curl -i -H 'User-Agent: () { :;}; echo; /usr/bin/id' http://TARGET:PORT/cgi-bin/SCRIPT
CGI response: uid=SERVICE_UID(...) gid=...Means: Command-derived identity output supports Shellshock execution under the CGI process.
Confirm: Separate command output from reflected header text and record the exact script/Bash context.
- After validation
- The bounded command effect repeats only with the crafted environment function: select the route.
- Ruled out in this context
- Patched Bash or a non-Bash CGI path produces no command effect: reject that chain.
- Still inconclusive
- A generic 500 or reflected payload leaves component behavior unresolved.
Troubleshooting: No effect can mean patched Bash, non-Bash CGI, header sanitization or wrong endpoint; re-check the component before another payload.
Use when a confirmed CGI endpoint passes HTTP-derived environment variables into an affected Bash process. An arbitrary PHP/Java route or a Bash version string alone does not establish this chain.
Read: an attributable UID in the executed CGI response supports the effect; reflection of the header text does not. Header/CGI parsing errors require inspecting the request and script behavior. No effect → re-check the actual component and patch status before selecting another PoC. This is the CVE-2014-6271 family, not a generic command separator for every web input.
Sources: upstream 1.
Why it works
Shellshock abuses Bash environment-function parsing; it is not a generic header payload for arbitrary PHP, Java or static routes.
Worked example · hypothetical
Observation: a CGI script and vulnerable Bash dependency are confirmed. Test: send one bounded identity command in a header. Illustrative output: the CGI response contains the target UID. Interpretation: command execution is proven.
New identity, privilege, host or route? Re-enumerate → All topic tasks →