I wouldn't trust this tool, at least not yet. I tried a knowned patched server a... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

err4nt on Sept 27, 2014 | parent | context | favorite | on: Shellshock BASH Vulnerability Tester

I wouldn't trust this tool, at least not yet.

I tried a knowned patched server and it gave me an unknown result.

Next I tried a known vulnerable server I don't have the authority to patch, and it said it timed out because my server didn't respond within 3 seconds.

Then it told me I had to wait 15 minutes to test that domain again.

0/2 when starting with known results, I wouldn't rely on this for anything you don't already know the status of.

shellshockernet on Sept 28, 2014 [–]

Can you submit an issue request to https://github.com/wreiske/shellshocker/issues and please provide the domain name used in the test. Thanks!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact