Certified Ethical Hacker (CEH) Practice Question

The payload beginning with "() { :; };" abuses the Shellshock vulnerability in GNU Bash. When Apache's CGI module translates HTTP headers into environment variables, Bash incorrectly treats the crafted value as a function definition and executes the appended command, giving the attacker remote code execution. Slowloris is a denial-of-service technique that holds connections open, not command execution. HTTP verb tampering relies on alternative methods like HEAD or DELETE to bypass restrictions but does not exploit Bash. POODLE targets SSL 3.0 negotiation, affecting encryption rather than the web server's request handling.