/docs/alerts/40013/">40013</a>.

<h2 id="id-10048">ShellShock - CVE-2014-6271</h2>

This rule perform 2 attacks to detect servers vulnerable to CVE-2014-6271 aka ShellShock.<br>
The first is a simple reflected attack and the second is a time based attack.<br>
<br>
Post 2.5.0 you can change the length of time used for the attack by changing the <code>rules.common.sleep</code> parameter via the Options 'Rule configuration' panel.
<p>
Latest code: <a href="https://github.com/zaproxy/zap-extensions/blob/main/ad