Shellshock is a vulnerability in the UNIX Bash shell that widely affects different products, including web applications that use Bash to process requests internally. It was assigned the vulnerability ID CVE-2014-6271, and until this day, we suspect there are many vulnerable products yet to be identifies.
The following recipe will show you how to detect web applications vulnerable to Shellshock with Nmap.
To identify all web applications vulnerable to Shellshock running on a web server, we can use the following command:
$ nmap -sV --script http-shellshock <target>If a web application is vulnerable, we will see a report like this one:
PORT STATE SERVICE REASON 80/tcp open http syn-ack | http-shellshock: | VULNERABLE: | HTTP Shellshock vulnerability | State: VULNERABLE (Exploitable) | IDs: CVE:CVE-2014-6271 | This web application might be affected by the vulnerability...