I am trying to detect if a server is vulnerable to heartbleed. To do this, only idea i have is to actually send a heartbeat packet having length field and actual payload having different length.

But since it is a specially crafted packet firewalls and softwares block this request.

Is there any other way to check for the heartbleed (OR openssl version)? As far as i know, openssl version is not sent by the server in any hello case.

  • 1
    If the packet is already blocked by firewall or software, wouldn't that mean they aren't vulnerable to Heartbleed? – d1str0 Feb 29 '16 at 16:03
  • 1
    One thing to note here is request is blocked by the originating network, so we are not able to distinguish if the request is blocked OR server is really not vulnerable. – Ouney Feb 29 '16 at 16:05
  • 1
    Then test it from a vantage point where it won't be blocked. – multithr3at3d Feb 29 '16 at 16:24

As you've already noticed there is no way to reliably get the OpenSSL version by just looking at the servers response. But even if you would somehow know the version (like if sent in the http Server header) you still don't know if the server is affected by the bug or not, since most distributions just backported the bugfix to the OpenSSL version they shipped and did not upgrade to a newer version.

As for other ways to check for the bug: they only way to check is to trigger the bug which means that you need to send a packet using the heartbeat extension.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.