This bug is super bad. It's a trivial exercise to modify the given PoC to dump memory of a vulnerable server continuously. You might be able view:
- x509 certs,
- RSA key material.
- Server side code & server side configs,
- Browser UA for other visitors
- Session IDS for other visitors.

On Tue, Apr 8, 2014 at 10:24 PM, Laban Mwangi <lmwangi@gmail.com> wrote:

I just came across heartbleed. It's a painful CVE. Upgrade time If you have software that offers SSL/TLS using OpenSSL.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
https://www.mattslifebytes.com/?p=533
https://www.michael-p-davis.com/using-heartbleed-for-hijacking-user-sessions/

Scanning a subset of popular KE sites show that most are not vulnerable thanks to IIS/OWA. However, a few .go.ke and .co.ke SSL sites are leaking website code, cookies and god forbid private keys.

Cheers,
Laban