Scanning heartbleed bug with the nmap NSE script

Following Heartbleed Bug: OpenSSL Security Flaw, services using secure protocols with OpenSSL 1.0.1 are no longer secure. Administrators using OpenSSL must check whether their systems have this vulnerability. With only a few servers, checking and fixing them is straightforward, but checking a large fleet can take considerable time. This article presents a way to save administrators time when making a preliminary check of whether their servers are affected by Heartbleed. The script checks whether Heartbeat is available. These nmap installation and usage instructions cover CentOS 6 only.

Installing ssl-heartbleed and updating the nmap server

Copy and run the script below to install the ssl-heartbleed script and update the nmap server.

#!/bin/bash
red='\e[0;31m'
NC='\e[0m' # No Color

echo -e "${red}Install Atomic repo${NC}"
rpm -ivh http://updates.atomicorp.com/channels/atomic/centos/6/x86_64/RPMS/atomic-release-1.0-18.el6.art.noarch.rpm

echo -e "\n${red}Update NMAP to version 6.40${NC}"
yum install nmap --enablerepo=atomic -y

if [ ! -e ~/ssl-heartbleed.nse ]; then
        echo -e "\n${red}Get ssl-heartbleed.nse ${NC}"
        cd ~ && wget https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse
fi

if [ ! -e /usr/share/nmap/nselib/tls.lua ]; then
        echo -e "\n${red}Get TLS NSELib ${NC}"
        wget https://svn.nmap.org/nmap/nselib/tls.lua -O /usr/share/nmap/nselib/tls.lua
fi

Run nmap with ssl-heartbleed script for scan your network

After the script finishes, run the following command to scan HTTPS.

nmap -p 443 --script ~/ssl-heartbleed.nse 192.168.0.100

Note:

1. To scan other ports, specify them or remove -p 443.
2. You can specify an IP subnet, such as 192.168.1.0/24.

Result

Scan output from a server at risk from Heartbleed

Nmap scan report for 192.168.0.100
Host is up (0.00035s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-heartbleed:
|   VULNERABLE:
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
|     Description:
|       OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
|       http://cvedetails.com/cve/2014-0160/
|_      http://www.openssl.org/news/secadv_20140407.txt
MAC Address: 00:55:55:95:1B:50 (VMware)