3

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL?

-- Clarification:

Speaking in terms external; as in, if I went probing around the web or Shodan, is there a way to identify servers that use OpenSSL?

To those who are wary, I'm just asking because I have to check if my servers are vulnerable;

-- Possible Method:

I found this on http://www.hacklabs.com/team-penetration-testing/2014/4/8/testing-for-the-tls-heartbleed-vulnerability.html:

$ openssl s_client -connect server.com:443 -tlsextdebug | grep “server extension”

Is this a method to identify if server.com uses openssl?

1

Some servers will advertise their OpenSSL version in the HTTP response headers from an HTTPS request. Example:

Server: Apache 2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o

These headers can (and often are) be disabled or not include this level of detail, so if OpenSSL isn't mentioned then it doesn't mean the server isn't using it.

  • 1
    For example to get these headers: curl -I https://httpd.apache.org gives third line as Server: Apache/2.4.9 (Unix) mod_wsgi/3.4 Python/2.7.5 OpenSSL/1.0.1g – dr jimbob May 9 '14 at 2:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.