‫The Heartbleed vulnerability.
‫Sounds tragic, doesn't it?
‫But open SSL is an open source cryptographic software library.
‫It implements the transport layer security or TLC and Secure Sockets Layer or SSL protocols.
‫And Heartbleed is indeed a very serious vulnerability caused by a flaw in open SSL.
‫So, in short, Heartbleed allows anyone to read the memory of systems protected by the vulnerable versions
‫of the open SSL.
‫So this compromises private keys, names and passwords of the users and the actual content.
‫Anyone can easily trick a vulnerable Web server into sending sensitive information.
‫This allows attackers to eavesdrop on communications and then steal data directly from the services
‫and the users and to impersonate the services and users.
‫Now beatbox as a service to test the vulnerability to heart bleed.
‫So to discover the service, we need to perform an Allport scan.
‫But I don't want to run this scam, so I'm just going to run a service scan on a specific box port,
‫so open terminal.
‫Type and map dash S.
‫S and IP address a B box.
‫And the number is 84, 43.
‫And then add dash as V for service scan.
‫And you might have to wait for a while, but the result will appear soon.
‫Still waiting and waiting and waiting.
‫Now, here's a result.
‫So the port is open and it is NASL Service and Ndeye and Exurbia version 1.0 four runs their.
‫OK, so we discover that port and then we can check if the service is vulnerable or not.
‫So Unmap has many scripts to extend its capability.
‫It has a script for checking Heartbleed vulnerability, so let's delete the service scan from the previous
‫command and then add script SSL, dash Heartbleed and hit enter.
‫And it will quickly check and the service is vulnerable.
‫What do you know?
‫OK, now, so to exploit it, we are going to use Métis boy.
‫Actually, there are many scripts and tools out there to do this, you can run one of them as well,
‫but I like using Métis Point for this example.
‫Now, it may take a little time to open.
‫So now we can start.
‫And there is an auxiliary module for Heartbleed in Métis Point, so choose it, use auxillary slash
‫scanner, slash SSL, slash open SSL, underscore Heartbleed.
‫Then type show actions.
‫Dump gathers what's in the memory of the target Keys detects and then gathers the private keys in the
‫memory of the target and scan checks to see if the server is vulnerable or not.
‫Oh, I forgot this action and I did it within, man.
‫That's OK.
‫So anyway, let's ignore that and say the action to dump.
‫And then it shows the options.
‫So I think we need a change only our hosts and our port.
‫So let's set our host to IP address of Bubis.
‫And then set our report to 84 or 43.
‫And there ain't nothing left to set.
‫So before running the module, go to Firefox.
‫And let's just visit some pages to load up the memory with some new data.
‫I'm going to log out.
‫And go to HDB service on Port 443 on beboppers.
‫And now we add exception to this security error.
‫So now I'm going to log in again.
‫And then open chrome and go to the same application, copy and paste your URL.
‫Except the security warning.
‫OK, I'm going to log in.
‫Then log out again.
‫This time, I'm going to log in with another user.
‫So I hope it's enough to load some of the important data into the memory box, we'll see.
‫So I did it manually, you can now do it automatically if you want.
‫But anyway, Open Meadows boy.
‫And run the module.
‫So, yeah, you may have to wait for a few seconds.
‫OK, so here is a module and it is executed and it saves a result in this file.
‫So let's have a look at that file, shall we?
‫So this data comes directly from the memory of PAYBOX.
‫And you get this without spending a long time to find an appropriate payload, so it is precious.
‫So let's look at the output.
‫We have cookies, usernames, passwords now.
‫I really don't want to take this lightly, but just think about.
‫If you were to perform this attack on a server that's used by thousands or more users, right?
‫I mean, it's a known vulnerability.
‫It was covered in the press just not too long ago.
‫So that means in the real world, you really do need to scan for.