In this tutorial we will be scanning a target for the well known Heartbleed SSL Bug using the popular Nmap tool on Kali Linux. The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library and was introduced on 31 December on 2011 and released in March 2012. This weakness allows the attacker to steal information protected by the SSL/TLS encryption which is very commonly used to secure internet connections. The official name for Heartbleed is CVE-2014-0160. A fix has been released and deployed by many OS and application vendors but when a vulnerable version of OpenSSL is used or when applications haven’t been patched by the user or vendor, the vulnerability can still be exploited. With Nmap’s SSL-Heartbleed script it takes us just a couple seconds to check for this vulnerability and should be part of any penetration test.
Scanning for Heartbleed with Nmap
Use the following command to scan a target for the Heartbleed SSL bug:
nmap -d –script ssl-heartbleed –script-args vulns.showall -sV [host]
When using the –script-args vulns.showall flag, Nmap will show you also when the target is not vulnerable.
As you can see on the screenshot the target host we have scanned is not vulnerable to Heartbleed. The scanning took only a few seconds and since a lot of applications have been vulnerable to Heartbleed we suggest you to run this script when performing a penetration test or security scan.
Nmap Heartbleed Scanning Video Tutorial
Latest posts by William Fieldhouse (see all)
- A John McAfee-Backed ICO Exposed Thousands of Peoples Documents Due to Security Blunder - April 26, 2018
- Latest Hacking News Podcast #13 - April 17, 2018
- Latest Hacking News Podcast #12 - April 16, 2018