Shellshock is a vulnerability in the GNU Bash shell that was widely used in Unix-based systems. The vulnerability allowed attackers to inject and execute code via environment variables.
An attacker could trigger the vulnerability by manipulating the HTTP_USER_AGENT variable in HTTP requests to execute arbitrary commands on a web server.
Below is an example of an HTTP request exploiting the Shellshock vulnerability:
GET /cgi-bin/any_script.cgi HTTP/1.1
Host: vulnerable.example.com
User-Agent: () { :;}; /bin/bash -c 'echo Hello, I am executing code!'In this example, the User-Agent header contains a Bash function followed by a command to execute. If the web server is vulnerable, it would execute the echo command.
Which header is mostly used to exploit Shellshock?
Sign-in to your account to access your hacking courses and cyber security labs.
Access all hacking courses and cyber security labs.