I am using Virtualbox internal network with Kali Linux and Ubuntu 12.04. The version of OpenSSL for the Ubuntu is 1.0.1 which should be vulnerable. I have created a HTTPS server using nginx on the Ubuntu and when i scan with nmap on the Kali Linux it shows that port 80 for http and port 443 for https is open. However, when i use the heartbleed exploit on Metasploit in Kali and run the check command it says:
[*] 192.168.1.70:443 The target is not exploitable [*] Checked 1 of 1 hosts (100% complete)
Running nmap with
nmap -d –script ssl-heartbleed –script-args vulns.showall -sV 192.168.1.70
also does not give me anything.
How do I create a heartbleed-vulnerable server? I dont mind trying out another method as long as it works. The method here was done following https://warroom.securestate.com/building-a-vulnerable-box-heartbleed/