Maybe the bash is invoked on some other request path, not just / which you are scanning. I would go with /login and such, or write a crawler to parse out where

Maybe the bash is invoked on some other request path, not just / which you are scanning. I would go with /login and such, or write a crawler to parse out where the login/logout URLs are and try those.