coronary

coronary 测试 CIDR 块是否存在 OpenSSL CVE-2014-0160（又名 Heartbleed）漏洞。 灵感来自 Jonathan Rudenberg 的 heartbleeder。 使用 root@kitploit: $ coronary 192.168.1.0/24 Scanning: 192.168.1.11/22 VULNERABLE - 192.168.1.71:443 has the heartbeat extension enabled and is vulnerable to CVE-2014-0160 SECURE -...

heartbleed

heartbleed 一个用Ruby编写的简单工具，用于测试您的服务器是否存在OpenSSL CVE-2014-0160漏洞。 声明 对于使用此工具可能造成的任何损害，本人概不负责。该工具旨在检查私有服务器的特定漏洞，并评估高流量下与用户相关的潜在数据泄漏。它作为内部安全审计工具进行分享。 依赖项 需要： Ruby Bundler 要安装这些先决条件，请首先为您的平台下载并安装Ruby。 然后，使用命令 gem install bundler 安装Bundler，并在项目根目录下运行 bundle install 获取项目依赖项。 使用方法 命令行用法为 ruby src/run.rb...

heartbleeder

Heartbleeder 测试你的服务器是否存在 OpenSSL CVE-2014-0160 又名 Heartbleed 漏洞。 警告 ：不保证结果的准确性，你应该通过检查自己的 OpenSSL 构建版本来独立验证。 欢迎提交拉取请求。 用法 root@kitploit: $ heartbleeder example.com 不安全 - example.com:443 已启用心跳扩展且存在漏洞 多主机 可以通过设置 -hostfile 标志为包含换行符分隔地址的文件来监控多个主机。默认情况下，Web 面板可通过 http://localhost:5000 访问。 测试 PostgreSQ...

heartbleed

HEARTBLEED：OpenSSL TLS 心脏出血漏洞 OpenSSL TLS 心跳扩展 - 内存泄露 - 多 SSL/TLS 版本漏洞扫描器与利用工具 需要： root@kitploit: sudo apt-get install nmap lolcat Java root@kitploit: sudo apt install default-jre default-jdk...

heartbleed-lab

Heartbleed 实验室 用于研究 Heartbleed 漏洞的教育实验室 （CVE-2014-0160）通过 Docker 内真实的易受攻击 OpenSSL 环境进行实验。 本项目使用 OpenSSL 1.0.1f 复现了一个易受攻击的 TLS 服务器，并实现了一个自定义的原始 TLS 心跳客户端，用于演示畸形心跳数据包如何触发内存泄露。 该实验室专为教育和研究目的而创建，尤其适用于研究： TLS 记录帧结构 心跳扩展解析 内存泄露漏洞 解析器信任失败 跨协议的帧结构不一致 Heartbleed 与 HTTP 反同步漏洞之间的概念相似性 当前项目结构 root@kitploit:...

Exploit for Out-of-bounds Read in Openssl

This is an exploit module/toolkit targeting the Heartbleed vulnerability CVE-2014-0160. The target product/service is OpenSSL, and the vulnerability class/vector is a buffer overflow in the TLS heartbeat extension, allowing for memory disclosure. The probable entry point is the ssl3writebytes...

K15159: OpenSSL vulnerability CVE-2014-0160

Security Advisory Description The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as...

SUSE CVE-2014-0160

The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys,...

OpenSSL Information Disclosure Vulnerability

The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information...

Information Disclosure Through Buffer Over-read

OpenSSL is vulnerable to information disclosure. OpenSSL does not correctly handle Heartbeat Extension packets, attackers can leverage this flaw to read sensitive information by triggering a buffer over-read. This is also known as Heartbleed...

Amazon Linux: Security Advisory (ALAS-2014-320)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandriva Linux Security Advisory : openssl (MDVSA-2015:062)

Multiple vulnerabilities has been discovered and corrected in openssl : Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service use-after-free and...

Oracle Linux 6 / 7 : openssl (ELSA-2014-1652)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1652 advisory. - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV t...

OpenSSL 1.0.1f TLS Heartbeat Extension - Memory Disclosure (Multiple SSL/TLS versions)

No description provided by source. Exploit Title: OpenSSL TLS Heartbeat Extension - Memory Disclosure - Multiple SSL/TLS versions Date: 2014-04-09 Exploit Author: Csaba Fitzl Vendor Homepage: http://www.openssl.org/ Software Link: http://www.openssl.org/source/openssl-1.0.1f.tar.gz Version: 1.0.1...

Beware Of Fake 'HeartBleed Bug Remover Tool', Hijacks System with Malware

I am considering that you all must have read my last article on OpenSSL Heartbleed, a critical bug in the OpenSSL's implementation of the TLS/DTLS heartbeat extension that allows attackers to read portions of the affected server’s memory, potentially revealing users data, that the server did not...

Digi International Gateways Vulnerable to Heartbleed

Wireless Web mesh gateways used everywhere from industrial control environments to home area networks are vulnerable to the Heartbleed OpenSSL vulnerability. The Industrial Control System Computer Emergency Response Team ICS-CERT issued an advisory Thursday warning SCADA and ICS managers with Dig...

APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3 AirPort Base Station Firmware Update 7.7.3 is now available and addresses the following: Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac Impact: An...

openssl: information disclosure in handling of TLS heartbeat extension packets

An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server...

TLS and DTLS Heartbeat Extension

The Heartbeat Extension allows keep-alive functionality for TLS/DTLS protocols. Heartbeat consists of two message types, HeartbeatRequest and HeartbeatResponse...

AIX OpenSSL Advisory : openssl_advisory7.doc (Heartbleed)

The version of OpenSSL running on the remote host is affected by an information disclosure vulnerability. OpenSSL incorrectly handles memory in the TLS heartbeat extension, potentially allowing a remote attacker to read the contents of up to 64KB of server memory, potentially exposing passwords,...