Testing for Heartbleed

Published: 2014-04-09. Last Updated: 2014-04-09 21:53:10 UTC
by Mark Hofman (Version: 1)
6 comment(s)

There are a fair few sites popping up testing for this issue.  I know this is possibly overly motherly, sorry, but be careful.  You may not know who is running the site, what they are actually testing for and what is done with the information collected.  Consider sticking to the main sites and known security organisations.  

Metasploit now has a module out (https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb). NMAP likewise has a check.  QUALYS has their SSLLABS page.  Other security vendors are also providing checks in their scanning products.  

Not saying the free scanners are "evil", just saying be careful what you use.  

Cheers

Mark H

Keywords:
6 comment(s)

Comments

When I use the SSL Labs site for citicard.com, I can't get a good read on that site. I don't have problems with some other financial sites I have run through the SSL Labs tester.

Anonymous

Apr 9th 2014
1 decade ago

C# stand-alone tool for testing via PacketStormSecurity (Have not tested):

"Authored by John Leitch
Bleed Out is a command line tool written in C# for targeting instances of OpenSSL made vulnerable by the prolific "Heartbleed" bug. The tool aggressively exploits the OpenSSL vulnerability, dumping both ASCII and binary data to files. It also checks the uniqueness of each chunk before persisting it, to ensure that duplicate chunks are not saved"

http://packetstormsecurity.com/files/126100
https://twitter.com/packet_storm

Anonymous

Apr 10th 2014
1 decade ago

NMAP hasn't released the version with the script to check for this yet.

There are instructions here http://rollingwebsphere.blogspot.com/2014/04/scanning-for-heartbleed-with-nmap.html for getting it up and running with version 6.40

Anonymous

Apr 10th 2014
1 decade ago

Please note that all online tests must be taken "cum grano salis".
At least one of them, in our checking, shows false positives.
-Marlon

Anonymous

Apr 10th 2014
1 decade ago

We have discovered that the NMAP script "ssl-heartbleed" may not be reliable. A scan of a Polycom HDX 7000 device did not reveal vulnerability. However, testing with another tool did. Upon checking firmware versions against Polycom's documented vulnerability list, we confirmed vulnerability.

Anonymous

Apr 11th 2014
1 decade ago

NMAP can be used for this too:

http://rollingwebsphere.blogspot.com/2014/04/scanning-for-heartbleed-with-nmap.html

Anonymous

Apr 14th 2014
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives