[antocv]

Maybe the bash is invoked on some other request path, not just / which you are scanning.

I would go with /login and such, or write a crawler to parse out where the login/logout URLs are and try those.