I have been hit by probes in the past that were delivering a shell shock validation string x='() { :;}; echo vulnerable' via a URL / browser based method hitting public facing web services.

What is the best way to approach this kind of validation manually (say during a penetration test)?

  • do you mean on web application parameters which accepts the input? If so, are you sure the input parameter does process, parses & actually goes to the cmd intake by the residing OS? Aug 18 '16 at 5:38

Depends on your definition of manual, but if I was looking for this on a penetration test, I'd be using Nmap's http-shellshock script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.