Nmap NSE Category vulns Script：ssl-heartbleed 檢測服務器是否容易受到CVE-2014-0160的影響
- Samuel
- 2024年6月4日
- 讀畢需時 1 分鐘
已更新：2024年8月6日
指令類型：portrule
Nmap Script摘要
檢測服務器是否容易受到OpenSSL心臟出血漏洞（CVE-2014-0160）的影響。該代碼基於Katie Stafford（katie@ktpanda.org）撰寫的Python腳本ssltest.py。
Nmap Script參數
ssl-heartbleed.protocols（默認嘗試所有）TLS 1.0、TLS 1.1或TLS 1.2
tls.servername參見tls庫的文檔。
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername參見smbauth庫的文檔。
mssql.domain, mssql.instance-all, mssql.instance-name, mssql.instance-port, mssql.password, mssql.protocol, mssql.scanned-ports-only, mssql.timeout, mssql.username參見mssql庫的文檔。
smtp.domain參見smtp庫的文檔。
randomseed, smbbasic, smbport, smbsign參見smb庫的文檔。
vulns.short, vulns.showall參見vulns庫的文檔。
Nmap Script範例
nmap -p 443 --script ssl-heartbleed <target>Nmap Script輸出
PORT STATE SERVICE
443/tcp open https
| ssl-heartbleed:
| VULNERABLE:
| The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
| State: VULNERABLE
| Risk factor: High
| Description:
| OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
| http://www.openssl.org/news/secadv_20140407.txt
|_ http://cvedetails.com/cve/2014-0160/Nmap Script作者:
Patrik Karlsson <patrik@cqure.net>
License: Same as Nmap--See https://nmap.org/book/man-legal.html
