2) Common sense.

SSI Injection (Server-side Include) is a server-side exploit technique that allows an attacker to send code into a web application, which will later be executed locally by the web server. SSI Injection exploits a web application's failure to sanitize user-supplied data before they are inserted into a server-side interpreted HTML file.

The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields.

If an attacker submits a Server-side Include statement, he may have the ability to execute arbitrary operating system commands, or include a restricted file's contents the next time the page is served.

Description Taken From: http://nightcode.weebly.com/ssi-injection.html

Lets get to work shall we :P

Enter inurl:bin/Cklb/ in Google and go testing...

So when you used that dork and you opened one site now you must determine id the site is vulnerable to this type of injection.

Here are some command you can use:

NOTE: You most enter your command into both fields (If login are vulnerable!!)

I have my site for example:

Now we see that our command successfully executed and that our site is vulnerable....

Now we must download it to our site like this:

So insert your site where your shell is hosted in the command and you are ready to go.

Now just paste it into the fields and press Login or Enter. 

To see if your .TXT file downloaded execute the command we used before:

You rename filenames what ever you need (Offcourse you will need to put your .TXT name first.)

My command: