Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking to improve my skills, to do so I need a site with an old OpenSSL version, so that I can do a pentest on my own.

share|improve this question

closed as off-topic by Iszi, Xander, TildalWave, Steve, dr jimbob May 2 at 20:37

This question appears to be off-topic. The users who voted to close gave these specific reasons:

If this question can be reworded to fit the rules in the help center, please edit the question.

1  
It would take you about 10 minutes to set one up yourself –  TildalWave May 2 at 18:55

2 Answers 2

It should be easy to create one of your own, which is usually preferable. Fire up apache, install an old libssl (prior to 1.0.1f) and give your install a self-signed cert. Then, generate some traffic with curl.

You should be able to fire up your exploit and start reading memory.

It's probably best to do this in a VM, since you don't want anyone else exploiting your test bed.

share|improve this answer

Cloudflare operates some servers over at cloudflarechallenge.com that are vulnerable to heartbleed.

You can verify it with nmap:

sudo nmap --script ssl-heartbleed cloudflarechallenge.com -d

443/tcp open  https   syn-ack
| ssl-heartbleed:
|   VULNERABLE:
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.