HeartBleed OpenSSL Vulnerability Easy-to-Read POC on Windows (Taking users' Facebook account)

2014-04-11

1982
0
2014-04-17

The website can be used to find HeartBleed vulnerability: http://filippo.io/Heartbleed
But it will not show the detail and leaking informaiton.
Most of the POC are using Python or C/C++, making it hard for general people to use.
Today, I made a HeartBleed quick and dirty PoC(Proof-Of-Concept) program on Windows.

The website can be used to find HeartBleed vulnerability: http://filippo.io/Heartbleed

But it will not show the detail and leaking informaiton.

Most of the POC are using Python or C/C++, making it hard for general people to use.

Today, I made a HeartBleed quick and dirty PoC(Proof-Of-Concept) program on Windows.

Download HeartBleed POC for Windows here

Usage:

unzip all

go to command line -> "heartbleed.exe [hostname]" (You can add "-p" to specify SSL port number)

Ex1: heartbleed.exe mamaclub.com

Ex2: heartbleed.exe telly.com

Notice:

You may need to test more than 10 times for a specific host to confirm the OpenSSL vulnerability. (對於同一個網站，可能要使用以上指令測試超過10次以上才能確認是否有存在OpenSSL漏洞)
Even if I use guest Linux in VMWare, my host anti-virus software blocks the connection when testing. Make sure you disable the anti-virus software before testing. (即使是使用VMWare上的guest Linux來測試，但封包仍會被Host端的防毒軟體擋下來，因此請確保您已經關閉防毒軟體或使用沒有防毒軟體的電腦來測試。目前實際測試過：紅色的T不會擋，黃色的N會擋)
No Python or Ruby runtime needed (這個PoC不需要有Python或Ruby的執行環境)

Demo image: