Shellshock (CVE-2014-6271)

Cross-platform resources for Shellshock (CVE-2014-6271): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Shellshock (CVE-2014-6271): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 4 challenges across 2 platforms — 3 HackTheBox · 1 PortSwigger. 3 with a Spanish writeup, 3 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Blind SSRF with Shellshock exploitation (Apprentice) · 🇬🇧
2. HackTheBox — Beep (Fácil) · 🇪🇸 🇬🇧 📹
3. HackTheBox — Shocker (Fácil) · 🇪🇸 🇬🇧 📹
4. HackTheBox — Ariekei (Insano) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-web/php-tricks-esp/php-useful-functions-disable_functions-open_basedir-bypass.html
Exploit-DB	https://www.exploit-db.com/exploits/34900

HTB machines practicing Shellshock (CVE-2014-6271) (3)

Machine	OS	Difficulty	Writeup
Ariekei	Linux	INSANE	🇪🇸 🇬🇧 📹
Beep	Linux	EASY	🇪🇸 🇬🇧 📹
Shocker	Linux	EASY	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Shellshock (CVE-2014-6271) (1)

Lab	Difficulty	Topic	Official
Blind SSRF with Shellshock exploitation	APPRENTICE	SSRF (Server-Side Request Forgery)	Open

Related skills

• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-08-17