I have been hit by probes in the past that were delivering a shell shock validation string x='() { :;}; echo vulnerable' via a URL / browser based method hitting public facing web services.

What is the best way to approach this kind of validation manually (say during a penetration test)?

  • do you mean on web application parameters which accepts the input? If so, are you sure the input parameter does process, parses & actually goes to the cmd intake by the residing OS? Aug 18, 2016 at 5:38

1 Answer 1


Depends on your definition of manual, but if I was looking for this on a penetration test, I'd be using Nmap's http-shellshock script.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .