NST Heartbleed Detection

Overview

This page shows how to use NST and nmap to detect the heartbleed vulnerability. Heartbleed is a software bug in the open-source cryptography library OpenSSL, which allows an attacker to read the memory of the host computer, allowing them to retrieve potentially privacy-sensitive data.

See the following sites for technical details on this vulnerability:

• CVE (Common Vulnerabilities and Exposures) CVE-2014-0160
• OpenSSL Security Advisory 20140407
• CVE Details

Heartbleed Detection - NST Pro System

NST 20
SVN: 5804

NST Pro users need to first update their NST system to get the latest version of nmap (i.e., v6.45 or greater) from the NST Pro repository. This release contains the nmap NSE (Nmap Scripting Engine) script: "/usr/share/nmap/scripts/ssl-heartbleed.nse" written by Patrik Karlsson which is based on code authored by Jared Stafford.

   

[root@probe ~]# yum update nmap;

.
.
.
====================================================================================================================================
 Package                         Arch                     Version                                    Repository                Size
====================================================================================================================================
Updating:
 nmap                            i686                     2:6.45-32817.10.nst20                      NstPro                   3.9 M
Updating for dependencies:
 nmap-frontend                   noarch                   2:6.45-32817.10.nst20                      NstPro                   685 k
 nmap-ncat                       i686                     2:6.45-32817.10.nst20                      NstPro                   124 k

Transaction Summary
====================================================================================================================================
.
.
.

[root@probe ~]#

Command Line

The following is an example nmap command for the detection of the "Heartbleed" vulnerability on host: "10.21.23.19" port: "443 (https)"

[root@probe ~]# nmap -p 443 --script ssl-heartbleed 10.21.23.19;

[root@probe ~]#

Heartbleed Detection - NST Public System

wget https://svn.nmap.org/nmap/nse_main.lua
wget https://svn.nmap.org/nmap/nselib/tls.lua
wget https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse