关联漏洞
标题:OpenSSL 缓冲区错误漏洞 (CVE-2014-0160)Description:OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL的TLS和DTLS实现过程中的d1_both.c和t1_lib.c文件中存在安全漏洞，该漏洞源于当处理Heartbeat Extension数据包时，缺少边界检查。远程攻击者可借助特制的数据包利用该漏洞读取服务器内存中的敏感信息(如用户名、密码、Cookie、私钥等)。以下版本的OpenSSL受到
Description
This repo contains a script to automatically test sites for vulnerability to the Heartbleed Bug (CVE-2014-0160) based on the input file for the urls.
介绍
HeartBleed-Vulnerability-Checker
================================
__author__ = 'WaQas-JaMal'
Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org) & The author disclaims copyright to this source code.
'''
I have modified this script to take any input url file. Check it for valid tld from provided set of urls, create unique set and parse that to the script for checking heartbleed vulnerability.
[For Contact: contact at waqasjamal dot com]
'''
#Update
Script now only clean URL instead of checking for valid tld.
Output Improved as well.
#Installation Guide
You do no need to install anything extra in order to test this script
# Usage example:
python check_heartbleed.py filename 10
#Tasks to do
1) Include IP in the list as well (It should be working now)
2) Multi threaded code
3) Try URL Parse instead of tld library (Done)
文件快照
[4.0K] /data/pocs/0f97a11d3acc04a81bd66005bb5429922f61c75a
├── [6.5K] check_heartbleed.py
├── [ 885] README.md
└── [5.9K] Top-10k-alexa_Vulnerable-domains-Apr-11-1100UTC2014
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。