CVE-2014-0160 PoC — OpenSSL 缓冲区错误漏洞

Source

https://github.com/waqasjamal-zz/HeartBleed-Vulnerability-Checker

Associated Vulnerability

Title: OpenSSL 缓冲区错误漏洞 (CVE-2014-0160)
Description:The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Description

This repo contains a script to automatically test sites for vulnerability to the Heartbleed Bug (CVE-2014-0160) based on the input file for the urls.

Readme

HeartBleed-Vulnerability-Checker
================================

__author__ = 'WaQas-JaMal'

Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org) & The author disclaims copyright to this source code.

'''
I have modified this script to take any input url file. Check it for valid tld from provided set of urls, create unique set and parse that to the script for checking heartbleed vulnerability.  
[For Contact: contact at waqasjamal dot com]
'''

#Update
Script now only clean URL instead of checking for valid tld. 
Output Improved as well.  

#Installation Guide
You do no need to install anything extra in order to test this script

# Usage example: 
python check_heartbleed.py filename 10



#Tasks to do
 1) Include IP in the list as well (It should be working now)
 2) Multi threaded code
 3) Try URL Parse instead of tld library (Done)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →