CVE-2014-0160 PoC — OpenSSL 缓冲区错误漏洞

Source

Associated Vulnerability

Title:OpenSSL 缓冲区错误漏洞 (CVE-2014-0160)
Description:The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Description

bleed is a tool to test servers for the 'Heartbleed' vulnerability (CVE-2014-0160).

Readme

# bleed

bleed is a tool to test servers for the '[Heartbleed](http://heartbleed.com)' vulnerability ([CVE-2014-0160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160)).

## Usage

```
$ bleed example.org
> Connecting...
> Sending Client Hello
  Waiting for Server Hello...
< Received message: type = 22, ver = 0302, length = 61
< Received message: type = 22, ver = 0302, length = 6442
< Received message: type = 22, ver = 0302, length = 331
< Received message: type = 22, ver = 0302, length = 4
> Sending Heartbeat request
Unexpected EOF receiving record header. Server closed connection.
No heartbeat response. Server likely not vulnerable.
```

## Installation

### Prerequisites

* The package manager [Composer](http://getcomposer.org).
* Composer global vendor directory in your path (e.g. `export PATH=~/.composer/vendor/bin:$PATH`).
* You might have to add `"minimum-stability": "dev"` to your global `composer.json` (by default in `~/.composer/composer.json`).

### Actual installation

```
composer global require 'dominik/bleed=dev-master'
```

Composer will now install `bleed` and its dependencies.

## Updating

```
composer global update 'dominik/bleed'
```

## Fineprint

*As your attorney, I advise you* to not use this software to do stuff that's not legal under the laws applicable to wherever you may be located and whatever you are doing with it. If you need an analogy: It may be allowed to run over things in your own backyard with your car, but in most jurisdictions it's probably illegal to run over things in the streets.

* [License](https://github.com/DominikTo/bleed/blob/master/LICENSE)
* [Disclaimer](http://knowyourmeme.com/memes/i-have-no-idea-what-im-doing)

File Snapshot


 [4.0K]  /data/pocs/3ef7f69945fa423abb234b68619200398324f8b5
├── [4.0K]  bin
│   └── [ 871]  bleed
├── [ 503]  composer.json
├── [4.0K]  lib
│   └── [4.0K]  bleed
│       ├── [4.1K]  bleed.php
│       └── [4.0K]  Payload
│           ├── [ 394]  Heartbeat.php
│           ├── [1.0K]  Hello.php
│           └── [ 590]  Payload.php
├── [1.5K]  LICENSE
└── [1.7K]  README.md

4 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!