As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or not?

  • 2
    @begueradj: I'm not sure this is a duplicate (related yes, but not duplicate). I have the impression that the OP already knows about Hearbleed vulnerability checkers, the question seems merely here to understand how do this checkers work since the OpenSSL version is not available remotely (no version banner for instance). Commented Aug 15, 2015 at 10:25
  • yes that's what i asked for .
    – Prometheus
    Commented Aug 15, 2015 at 17:19

1 Answer 1


The Heartbleed bug involves asking the server to return a block of memory that is larger than the actual information being returned. A vulnerable server will return whatever is in memory beyond the data structure it's returning. So, if you ask a server to return the extra memory and it does, then the server is vulnerable.

You can examine the code diffs for the patch here. There's a lot of duplication in the code but the basic change is to add this:

if (1 + 2 + payload + 16 > s->s3->rrec.length)
    return 0; /* silently discard */

So you can see how it now fails if you request a buffer larger than the actual size.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .