Full Disclosure mailing list archives
Re: heartbleed.c
From: Hacker Fantastic <hackerfantastic () googlemail com>
Date: Fri, 11 Apr 2014 00:15:49 +0100
Updated version, the heartbleed leak returned incorrect TLS record sizes (kudos to Andrea Shepard @ tor for pointing this out) but was still leaking the requested amount. Earlier code was returning only 16k of data as I relied on the TLS record size. This version will leak upto 64K of data from client or server heap. On Thu, Apr 10, 2014 at 3:25 PM, Hacker Fantastic < hackerfantastic () googlemail com> wrote:
Exploit for CVE-2014-0160 - client/server exploit and uses encrypted stream to leak bytes for IDS evasion. Can adjust heartbeat payload_length to leak fewer bytes and also has support for pre_cmd's i.e. STARTTLS.
-- Matthew Hickey Tel: +44 7543 661237 Web: http://blog.hackerfantastic.com Please visit my website for blog postings, status updates and project information.
Attachment:
heartbleed.c
Description:
_______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- heartbleed.c Hacker Fantastic (Apr 10)
- Re: heartbleed.c Hacker Fantastic (Apr 10)
- Message not available
- Re: heartbleed.c Hacker Fantastic (Apr 10)
- Message not available
- Re: heartbleed.c Hacker Fantastic (Apr 10)