Choose how you attend: SANS Network Security 2020 offers 35+ courses in Las Vegas OR Live Online!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Shellshock hands-on

  • Wednesday, February 25, 2015 at 3:00 PM EST (2015-02-25 20:00:00 UTC)
  • Eric Conrad

You can now attend the webcast using your mobile device!



In this talk we will walk you through the Shellshock bash exploit, from Proof of Concept to shell access. We'll explain the vulnerability in detail. Then we will show you how automated tools like Metasploit work their magic, break it down step-by-step, and then manually upload, install, execute, and log into a remote shell on a web server. This webcast will feature a live demonstration of the exploit, and leave you better prepared to test your systems for the Shellshock vulnerability.

Speaker Bio

Eric Conrad

Certified SANS instructor Eric Conrad's career began in 1991 as a Unix sysadmin for a small oceanographic communications company. He gained experience in a variety of industries, including research, education, power, Internet, and healthcare, and has worked with companies such as Mitsubishi Electric Research Labs, Boston University, The Open Group, Navipath, and Caritas Christi Health Care. He is now an independent information security consultant focusing on intrusion detection, incident handling, and penetration testing. He is a graduate of the SANS Technology Institute with a Master of Science degree in information security engineering. In addition to the CISSP, he holds the prestigious GIAC Security Expert (GSE) certification as well as the GIAC GPEN, GCIH, GCIA, GCFA, GAWN, and GSEC certifications. He is a contributing author to SANS HIPAA Security Implementation. Eric also blogs about information security at

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.