3 ms·

If one were using ASLR would this have mostly mitigated this? (I just rebuilt without the heartbeat extension but I'm curious). Also how exploitable is this?

by anaphor 13y ago

mpyne 13y ago
I don't think ASLR helps here one single bit.
ccpost 13y ago
I've been running the exploit against our test app (through AWS ELB), and have managed to get a fair bit of data out. Got snippets from HTTP requests on other threads including session cookies and even login passwords.