Hack Like a Pro: How to Scan the Internet for Heartbleed Vulnerabilities

Welcome back, my budding hackers!

Recently, I showed you how you could exploit the widely disseminated OpenSSL vulnerability that has to become known as "Heartbleed". Although the world has known about this vulnerability for over a month now, it will likely take many more months—or even years—for everyone to close this vulnerability.

Last week, Errata Security scanned the Web on port 443 looking for servers still affected by Heartbleed, and found over 300,000+ servers possibly still vulnerable, as compared to the 600,000+ from a month ago. If history is any judge, some websites will likely never patch this vulnerability. If that is the case, we can keep using this exploit for some time to come.

In this tutorial, I will show you how to test a website/IP address to determine whether the Heartbleed vulnerability is available to you.

Step 1: Open Kali & Nmap

The first step is fire up Kali and get an nmap prompt. Fortunately, nmap is in our PATH variable and we can run it from any command prompt. The folks at insecure.org (Fyodor and friends) developed a script that scans a website to determine whether it is vulnerable to the OpenSSL vulnerability. That is what we will be using here.

Step 2: Download Heartbleed Scanner

With Kali open, we first need to download and install the Heartbleed scanner script for nmap. You can find it here. Download and save it to the directory /usr/share/nmap/scripts.

Of course, you can just copy and paste it into the Leafpad text editor in Kali (or any text editor) to the same location.

Image Credit wonderhowto.com

Step 3: Download & Install the Library File

The nmap Heartbleed scanner requires a special library file to be effective. That file is tls.lua. Download it here or copy it to usr/share/nmap/nselib.

Step 4: Run It Against Websites

With the Heartbleed script and the tls.lua library in place, we now are ready to begin hunting for vulnerable websites. The syntax for running this script is:

nmap -sV --script=ssl-heartbleed 192.168.89.186

Remember, I'm running it against a web server in my lab on my LAN here. When running against web servers on the Internet, simply replace my private IP with the public IP of the web server.

Image Credit wonderhowto.com

If the website is vulnerable to the Heartbleed attack, it should get results similar that below.

Image Credit wonderhowto.com

As most web administrators are slow to patch vulnerabilities, many web servers are still vulnerable to the Heartbleed attack. You can use this tool to find those servers and then use the Heartbleed exploit to extract critical information from the memory of the server, if it is vulnerable.

Heartbleed image via Shutterstock