Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to improve my skills, to do so I need a site with an old OpenSSL version, so that I can do a pentest on my own.

share|improve this question

closed as off-topic by Iszi, Xander, TildalWave, Steve, dr jimbob May 2 '14 at 20:37

This question appears to be off-topic. The users who voted to close gave these specific reasons:

If this question can be reworded to fit the rules in the help center, please edit the question.

It would take you about 10 minutes to set one up yourself – TildalWave May 2 '14 at 18:55

It should be easy to create one of your own, which is usually preferable. Fire up apache, install an old libssl (prior to 1.0.1f) and give your install a self-signed cert. Then, generate some traffic with curl.

You should be able to fire up your exploit and start reading memory.

It's probably best to do this in a VM, since you don't want anyone else exploiting your test bed.

share|improve this answer

Cloudflare operates some servers over at that are vulnerable to heartbleed.

You can verify it with nmap:

sudo nmap --script ssl-heartbleed -d

443/tcp open  https   syn-ack
| ssl-heartbleed:
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.