Shellshock successful exploitation detection

Zeek
1

I just pushed out an expanded take on a ShellShock detector that watches for successful exploitation.

  https://github.com/broala/bro-shellshock

It logs all of the possible attacks over HTTP in http.log too.

  .Seth