heartpatch.us

heartpatch.us En Construcción Parcheando vulnerabilidades Heartbleed de OpenSSL en servidores de toda la World Wide Web. Inspiración Heartbleed es un bug de seguridad en la librería criptográfica OpenSSL, una implementación ampliamente utilizada del protocolo Transport Layer Security TLS. Fue...

openmagic

openmagic openmagic can assist you in the automating testing and exploiting of systems vulnerable to the OpenSSL TLS heartbeat read overrun CVE-2014-0160. The base module wraps a modified version of the "ssltest.py" program by Jared Stafford and provides the following additional features: Save th...

heartbleed-PoC

Heartbleed 概念验证 使用服务器 https://www.cloudflarechallenge.com/ 来尝试此攻击的一个 Heartbleed 攻击示例。 首先，我读过的关于这个主题的两个最佳解释： http://www.seancassidy.me/diagnosis-of-the-openssl-heartbleed-bug.html http://xkcd.com/1354/ 漏洞利用 该漏洞利用首先向服务器 cloudflarechallenge.com 发送握手请求，以通过 TLS 建立安全连接。然后函数 hithbs 发送一个典型的心跳请求：...

CVE-2014-0160

💔 CVE-2014-0160 — "Heartbleed" 📖 Tabla de contenido Resumen Antecedentes técnicos Causa raíz Impacto Versiones afectadas Resumen de explotación Mitigación y parche Cronología Lecciones aprendidas Resumen 🔎 Resumen Heartbleed es el apodo de CVE-2014-0160 , una vulnerabilidad grave en la extensión...

CVE-2014-0160.

CVE-2014-0160 Laboratorio para montar un laboratorio usando Heartbleed para filtrar memoria de aplicaciones web Este repositorio se centra en construir un contenedor para crear un entorno fácil de explotar nginx utilizando la técnica Heartbleed, enfocándose en: Montar el entorno usando Docker...

HeartbleedAttack

Heartbleed 攻击：基于 Java 的攻击演示 概述 本仓库包含 Heartbleed.java，这是一个基于 Java 的自定义漏洞利用程序，旨在通过从运行 Apache（端口 443）和 Postfix（端口 465）的易受攻击服务器（IP：192.168.1.132）中提取敏感数据，来演示 Heartbleed 漏洞（CVE-2014-0160）。该漏洞利用程序发送畸形的 TLS 心跳请求，利用未修补的 OpenSSL 版本（1.0.1 至 1.0.1f）中的漏洞，每次请求最多可泄漏 64KB 内存。配套的 Bash 脚本（apachememload.sh 和...

Heartbleed-PoC-Exploit-Script

Heartbleed-PoC-Exploit-Script Este script de prueba de concepto PoC en Python detecta la vulnerabilidad Heartbleed CVE-2014-0160 realizando un handshake TLS con la extensión heartbeat y enviando una solicitud heartbeat manipulada. Analiza las respuestas del servidor para identificar memoria...

CVE-2014-0160

CVE-2014-0160 使用Heartbleed泄漏web应用内存的实验室搭建 该仓库专注于构建一个容器，以创建一个可以轻松利用Heartbleed技术攻击nginx的环境，重点包括： 使用Docker搭建环境 服务器设置示意图 演示步骤 服务器示意图 CVE-2014-0160 问题出现在OpenSSL库提供TLS心跳功能时，其缓冲区大小为64KB，导致内存溢出，从而泄漏服务器内存中的敏感信息。 攻击流程 使用负载heartbleed.py Web应用正在处理敏感消息，这些消息被nginx缓存到内存中。 我们通过检查环境是否支持TLS心跳来利用： openssl sclient...

Mail.ru: scfbp.tng.mail.ru: Heartbleed

MacBook-Pro-Kirill:Pentest isox$ python heartbleed.py scfbp.tng.mail.ru defribulator v1.16 A tool to test and exploit the TLS heartbeat vulnerability aka heartbleed CVE-2014-0160 Connecting to: scfbp.tng.mail.ru:443, 1 times Sending Client Hello for TLSv1.0 Received Server Hello for TLSv1.0...

Oracle Linux 6 / 7 : openssl (ELSA-2014-1652)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1652 advisory. - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV t...

HP Version Control Repository Manager (VCRM) Heartbeat Information Disclosure (Heartbleed)

The HP Version Control Repository Manager VCRM install on the remote Windows host is version 7.2.0, 7.2.1, 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS...

HP Version Control Agent (VCA) Heartbeat Information Disclosure (Heartbleed)

The RPM installation of HP Version Control Agent VCA on the remote Linux host is version 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions...

HP Version Control Agent (VCA) Heartbeat Information Disclosure (Heartbleed)

The RPM installation of HP Version Control Agent VCA on the remote Linux host is version 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions...

Kerio Connect 8.2.x < 8.2.4 Heartbeat Information Disclosure (Heartbleed)

According to its banner, the remote host is running a version of Kerio Connect formerly Kerio MailServer version 8.2.x prior to 8.2.4. It is, therefore, affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS...

Triangle MicroWorks SCADA Data Gateway < 3.3.729 Heartbeat Information Disclosure (Heartbleed)

Binary data scadatrianglegateway33729.nbin...

Attachmate Reflection X Heartbeat Information Disclosure (Heartbleed)

The Attachmate Reflection X install on the remote host is affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat extensions that could allow an attacker to obtain sensitive information such as primary...

Blue Coat ProxyAV 3.5.1.1 - 3.5.1.6 Heartbeat Information Disclosure (Heartbleed)

According to its self-reported version number, the firmware installed on the remote host is affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions that could allow an attacker to obtain...

Symantec Endpoint Protection Manager < 12.1 RU4 MP1a OpenSSL Heartbeat Information Disclosure (Heartbleed)

According to its self-reported version number, the version of Symantec Endpoint Protection Manager SEPM installed on the remote host is affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat extension...

Digi International Gateways Vulnerable to Heartbleed

Wireless Web mesh gateways used everywhere from industrial control environments to home area networks are vulnerable to the Heartbleed OpenSSL vulnerability. The Industrial Control System Computer Emergency Response Team ICS-CERT issued an advisory Thursday warning SCADA and ICS managers with Dig...

APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-04-22-4 AirPort Base Station Firmware Update 7.7.3 AirPort Base Station Firmware Update 7.7.3 is now available and addresses the following: Available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac Impact: An...