Browse to bee-box over HTTP (http://192.168.56.12/bWAPP/) and log in to start this exercise:
- In the Choose your bug: drop-down box, select Shellshock Vulnerability (CGI) and then click on Hack:
In the text, we can see something interesting: Current user: www-data. This may mean that the page is using system calls to get the username. It also gives us a hint to attack the referrer.
- Let's see what is happening behind the scenes and use Burp Suite to record the requests and reload the page. If we look at the proxy's history:
We can see that there is an iframe calling a shell script: /cgi-bin/shellshock.sh, which might be ...
