On: Everything you need to know about the Shellshock Bash bug

[fiedzia]

wget --header='Referer: () { :;}; touch /tmp/vulnerable ' www.example.com

[bodyfour → fiedzia]

Note that you'll typically want to supply the URL to a CGI script on the site, not just www.example.com. Don't think you're unaffected just because the top-level page of your site doesn't appear vulnerable.

[earlz → fiedzia]

Is there some easy way of detecting a site you don't control is vulnerable without bringing it down?

[nkurz → earlz]

Yes, you can ask it to ping an address you control and record where the pings come from.