[jrochkind1]

Yeah, that makes sense. Did you try it?

Gets me ~6k of hits that have just 'sh' in the URL (without the dot), and are not what we're looking for, mostly forum posts asking about how to make a bash cgi-bin. (Answer from the future: don't).

I _think_ putting quotes around the ".sh" is supported to force the result to really have the period before the sh in the url.

inurl:cgi-bin inurl:".sh"

0 hits

[nisa]

    inurl:cgi-bin "inurl:\.sh$"

320k results here. The slash and $ made a difference but they are not parsed as regex other chars work too. Not sure what's going on here.