News for hackers. Stuff that matters.

A comment on Shell Shock Exploitation Vectors. Parent comment

Re:Shell Shock Exploitation Vectors by xorcist on Sunday September 28, 2014 @04:35AM (#8379254)
It looks like you have dumped the a PHP global variable, possibly $_ENV. Do you know of any circumstances where _ENV, or any other PHP variable with potentially untrusted data, is passed in environment variables?
[ Parent | on HN ]
Re:Shell Shock Exploitation Vectors by moduloo on Sunday September 28, 2014 @06:03AM (#8379344)
i'm working on it it, but it looks like it works only under rare conditions
[ Parent | on HN ]