Skip to main content
This page aggregates cross-platform resources to practice Shellshock (CVE-2014-6271): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills. Coverage: 4 challenges across 2 platforms — 3 HackTheBox · 1 PortSwigger. 3 with a Spanish writeup, 3 with a video writeup.

​
Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.
  1. PortSwigger — Blind SSRF with Shellshock exploitation (Apprentice) · 🇬🇧
  2. HackTheBox — Beep (Fácil) · 🇪🇸 🇬🇧 📹
  3. HackTheBox — Shocker (Fácil) · 🇪🇸 🇬🇧 📹
  4. HackTheBox — Ariekei (Insano) · 🇪🇸 🇬🇧 📹

​
Curated resources

​
HTB machines practicing Shellshock (CVE-2014-6271) (3)

​
PortSwigger labs practicing Shellshock (CVE-2014-6271) (1)

← Back to the full glossary Last updated: 2026-08-17