3

I was thinking that maybe the banners can give some insight as to whether a server is using OpenSSL. Is there any tell tale signs that a server is using OpenSSL?

-- Clarification:

Speaking in terms external; as in, if I went probing around the web or Shodan, is there a way to identify servers that use OpenSSL?

To those who are wary, I'm just asking because I have to check if my servers are vulnerable;

-- Possible Method:

I found this on http://www.hacklabs.com/team-penetration-testing/2014/4/8/testing-for-the-tls-heartbleed-vulnerability.html:

$ openssl s_client -connect server.com:443 -tlsextdebug | grep “server extension”

Is this a method to identify if server.com uses openssl?

1 Answer 1

1

Some servers will advertise their OpenSSL version in the HTTP response headers from an HTTPS request. Example:

Server: Apache 2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o

These headers can (and often are) be disabled or not include this level of detail, so if OpenSSL isn't mentioned then it doesn't mean the server isn't using it.

1
  • 1
    For example to get these headers: curl -I https://httpd.apache.org gives third line as Server: Apache/2.4.9 (Unix) mod_wsgi/3.4 Python/2.7.5 OpenSSL/1.0.1g
    – dr jimbob
    May 9, 2014 at 2:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .