5 ms·

I've built a web tester for this bug, find it at http://filippo.io/Heartbleed/ http://filippo.io/Heartbleed/ It actually exploit the bug, since it was quite t

I've built a web tester for this bug, find it at http://filippo.io/Heartbleed/ http://filippo.io/Heartbleed/ It actually exploit the bug, since it was quite trivial, and echo some memory. It's written in Go, no more than 100 lines. I'll release code in some time.

endeavour 13y ago
Nice work
chirayuk 13y ago
Would love to see the code and test it against a rebuilt a patched nginx.
- danielhlockard 13y ago
  Just run it against it?
  - chirayuk 13y ago
    Well, I was interested in actually testing it out in code. I got it working with the pyOpenSSL bindings (I had to expose struct ssl_method_st, SSL_get_ssl_method, ssl_write_bytes and rebuild cryptography for pyOpenSSL.) Fun times.
- somuser01 13y ago
  Filippo has hosted it with github. https://github.com/FiloSottile/Heartbleed https://github.com/FiloSottile/Heartbleed
edwintorok 13y ago
It says that the heartbleed.com site itself is vulnerable.
- edwintorok 13y ago
  Looks like its fixed
raphinou 13y ago
My upgraded debian and ubuntu boxes are still reported as vulnerable.... Who's wrong, who's right?
- ch0wn 13y ago
  Have you restarted the services linked against openssl? lsof | grep ssl | grep DEL
  - raphinou 13y ago
    It was indeed the restart step that was missing
leocassarani 13y ago
Interestingly, your tool claims our website (SSL-terminated at our ELB instance) is still vulnerable; while this other tool (http://possible.lv/tools/hb http://possible.lv/tools/hb) claims we are unaffected. Another, known unpatched, app is reported to be affected by both tools. Is it possible that FiloSottile/Hearbleed may report false positives?
- danielweber 13y ago
  From what I've learned, it reports back if it gets something, when it should get nothing. How vulnerable a specific site is depends on luck. Yahoo must have broken a whole bunch of mirrors because total amateurs can send mail.yahoo.com a certain blob of code and it has a good chance of returning a stranger's password.
dewey 13y ago
Exactly what I was looking for, thanks! This should be part of the official heartbleed site not hidden away in comments here.

endeavour 13y ago

Nice work

chirayuk 13y ago

Would love to see the code and test it against a rebuilt a patched nginx.

danielhlockard 13y ago
Just run it against it?
- chirayuk 13y ago
  Well, I was interested in actually testing it out in code. I got it working with the pyOpenSSL bindings (I had to expose struct ssl_method_st, SSL_get_ssl_method, ssl_write_bytes and rebuild cryptography for pyOpenSSL.) Fun times.
somuser01 13y ago
Filippo has hosted it with github. https://github.com/FiloSottile/Heartbleed https://github.com/FiloSottile/Heartbleed

edwintorok 13y ago

It says that the heartbleed.com site itself is vulnerable.

edwintorok 13y ago
Looks like its fixed

raphinou 13y ago

My upgraded debian and ubuntu boxes are still reported as vulnerable.... Who's wrong, who's right?

ch0wn 13y ago
Have you restarted the services linked against openssl? lsof | grep ssl | grep DEL
- raphinou 13y ago
  It was indeed the restart step that was missing

leocassarani 13y ago

Interestingly, your tool claims our website (SSL-terminated at our ELB instance) is still vulnerable; while this other tool (http://possible.lv/tools/hb http://possible.lv/tools/hb) claims we are unaffected. Another, known unpatched, app is reported to be affected by both tools. Is it possible that FiloSottile/Hearbleed may report false positives?

danielweber 13y ago
From what I've learned, it reports back if it gets something, when it should get nothing. How vulnerable a specific site is depends on luck. Yahoo must have broken a whole bunch of mirrors because total amateurs can send mail.yahoo.com a certain blob of code and it has a good chance of returning a stranger's password.

dewey 13y ago

Exactly what I was looking for, thanks! This should be part of the official heartbleed site not hidden away in comments here.