FiloSottile / Heartbleed

A checker (site and tool) for CVE-2014-0160
http://filippo.io/Heartbleed
MIT License
2.31k stars 465 forks source link

Interpreting the output #56

Open gzigg opened 10 years ago

gzigg commented 10 years ago

Hi there Filippo, first of all thank you so much for writing this handy tool. I've installed it at work and am running it off my windows machine using a powershell script to check internal hosts (as well as our external hosts). I will post the powershell wrapper here shortly although I am not a "coder" it is extremely simple and just a wrapper to run your script.

I had a question about interpreting the output of your Heartbleed script, for example I am getting these results (among the detected VULNERABLE and CLEANs):

1) 2014/04/09 11:17:47 10.48.101.36:443 - ERROR: tls: failed to parse certificate from server: x509: negative serial number

2) 2014/04/09 11:14:42 10.50.1.1:443 - ERROR: tls: server selected unsupported protocol version 300

3) 2014/04/09 11:31:28 10.32.42.105:443 - ERROR: remote error: bad record MAC

Do you have a list of possible outcomes to understand whether that means those IP addresses should be tested further or any other way to interprest this output. Thanks.