title: Can not exploit shellshock vulnerability for all files
body: <p>I have been trying to exploit the Shellshock vulnerability in my system and ran into an interesting problem. I have been using 'wget' to exploit the vulnerability. The command I am using is as follows:</p>
  
  <pre><code>wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://somesite.com/some-script.cgi
  </code></pre>
  
  <p>Using the above command, the vulnerability shows as expected. However, when I try to wget a file which is not a .cgi file, the vulnerability does not show up and only the file is downloaded.</p>
  
  <p>From what I understand, wget should set the User-Agent string to the value passed in the command which should run the code <code>/bin/cat /etc/passwd</code> and I fail to see how this has anything to do with the nature of the file being downloaded. </p>
  
  <p>Thanks in advance.</p>