The Heartbleed vulnerability.
Sounds tragic, doesn't it?
But open SSL is an open source cryptographic software library.
It implements the transport layer security or TLC and Secure Sockets Layer or SSL protocols.
And Heartbleed is indeed a very serious vulnerability caused by a flaw in open SSL.
So, in short, Heartbleed allows anyone to read the memory of systems protected by the vulnerable versions
of the open SSL.
So this compromises private keys, names and passwords of the users and the actual content.
Anyone can easily trick a vulnerable Web server into sending sensitive information.
This allows attackers to eavesdrop on communications and then steal data directly from the services
and the users and to impersonate the services and users.
Now beatbox as a service to test the vulnerability to heart bleed.
So to discover the service, we need to perform an Allport scan.
But I don't want to run this scam, so I'm just going to run a service scan on a specific box port,
so open terminal.
Type and map dash S.
S and IP address a B box.
And the number is 84, 43.
And then add dash as V for service scan.
And you might have to wait for a while, but the result will appear soon.
Still waiting and waiting and waiting.
Now, here's a result.
So the port is open and it is NASL Service and Ndeye and Exurbia version 1.0 four runs their.
OK, so we discover that port and then we can check if the service is vulnerable or not.
So Unmap has many scripts to extend its capability.
It has a script for checking Heartbleed vulnerability, so let's delete the service scan from the previous
command and then add script SSL, dash Heartbleed and hit enter.
And it will quickly check and the service is vulnerable.
What do you know?
OK, now, so to exploit it, we are going to use Métis boy.
Actually, there are many scripts and tools out there to do this, you can run one of them as well,
but I like using Métis Point for this example.
Now, it may take a little time to open.
So now we can start.
And there is an auxiliary module for Heartbleed in Métis Point, so choose it, use auxillary slash
scanner, slash SSL, slash open SSL, underscore Heartbleed.
Then type show actions.
Dump gathers what's in the memory of the target Keys detects and then gathers the private keys in the
memory of the target and scan checks to see if the server is vulnerable or not.
Oh, I forgot this action and I did it within, man.
That's OK.
So anyway, let's ignore that and say the action to dump.
And then it shows the options.
So I think we need a change only our hosts and our port.
So let's set our host to IP address of Bubis.
And then set our report to 84 or 43.
And there ain't nothing left to set.
So before running the module, go to Firefox.
And let's just visit some pages to load up the memory with some new data.
I'm going to log out.
And go to HDB service on Port 443 on beboppers.
And now we add exception to this security error.
So now I'm going to log in again.
And then open chrome and go to the same application, copy and paste your URL.
Except the security warning.
OK, I'm going to log in.
Then log out again.
This time, I'm going to log in with another user.
So I hope it's enough to load some of the important data into the memory box, we'll see.
So I did it manually, you can now do it automatically if you want.
But anyway, Open Meadows boy.
And run the module.
So, yeah, you may have to wait for a few seconds.
OK, so here is a module and it is executed and it saves a result in this file.
So let's have a look at that file, shall we?
So this data comes directly from the memory of PAYBOX.
And you get this without spending a long time to find an appropriate payload, so it is precious.
So let's look at the output.
We have cookies, usernames, passwords now.
I really don't want to take this lightly, but just think about.
If you were to perform this attack on a server that's used by thousands or more users, right?
I mean, it's a known vulnerability.
It was covered in the press just not too long ago.
So that means in the real world, you really do need to scan for.