993510 - Heartbleed on https://myfirefox.com.tw

Status: RESOLVED FIXED

(Websites :: Mozilla Community Sites, defect)

Description

[evans.hsu]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.152 Safari/537.36

Steps to reproduce:

1. download https://gist.github.com/takeshixx/10107280
2. python hb-test.py myfirefox.com.tw



Actual results:

You can see realtime end-users HTTP request (including headers and cookie)

Comment 1

[evans.hsu]

more detail with heartbleed exploit: http://heartbleed.com/

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Domain Name: myfirefox.com.tw
Registrant:
American Mozilla Taiwan Branch
MOZ 2008 CORPORATION
4F-A1, No.106, Sec. 5, Xinyi Rd., Xinyi Dist., Tai

    Contact:
       Clarice Wang [e-mail]
       TEL: [phone] # 326
       FAX: [phone]

    Record expires on 2016-08-31 (YYYY-MM-DD)
    Record created on 2012-08-23 (YYYY-MM-DD)

    Domain servers in listed order:
       rsdn1.octor.com 210.200.66.80
       rsdn2.octor.com 210.200.183.23

Registration Service Provider: APT

Comment 3

[evans.hsu]

looks like it's fixed now.

Comment 4

[Daniel Veditz [:dveditz]]

This is a community-run site and is not eligible for a bug bounty