musalbas / heartbleed-masstest

Multi-threaded tool for scanning many hosts for CVE-2014-0160.

This tool allows you to scan multiple hosts for Heartbleed, in an efficient multi-threaded manner.

This tests for OpenSSL versions vulnerable to Heartbleed without exploiting the server, so the heartbeat request does not cause the server to leak any data from memory or expose any data in an unauthorized manner. This Mozilla blog post outlines the method used.

Usage: ssltest.py  [network2] [network3] ...

Test for SSL heartbleed vulnerability (CVE-2014-0160) on multiple domains

Options:
  -h, --help            show this help message and exit
  -p PORT, --port=PORT  Port to scan on all hosts or networks, default 443
  -i INPUT_FILE, --input=INPUT_FILE
                        Optional input file of networks or ip addresses, one
                        address per line
  -o LOG_FILE, --logfile=LOG_FILE
                        Optional logfile destination
  --resume              Do not rescan hosts that are already in the logfile
  -t TIMEOUT, --timeout=TIMEOUT
                        How long to wait for remote host to respond before
                        timing out
  --threads=THREADS     If specific, run X concurrent threads
  --json=JSON_FILE      Save data as json into this file
  --only-vulnerable     Only scan hosts that have been scanned before and were
                        vulnerable
  --only-unscanned      Only scan hosts that appear in the json file but have
                        not been scanned
  --summary             Useful with --json. Don't scan, just print old results
  --verbose             Print verbose information to screen
  --max=MAX             Exit program after scanning X hosts. Useful with
                        --only-unscanned

heartbleed-masstest's Issues

line 167

python --version
Python 2.7.3

Traceback (most recent call last):
File "ssltest.py", line 176, in
main()
File "ssltest.py", line 167, in main
if int(rank) >= int(args[1]):
IndexError: list index out of range

Fool.com is NOT vulnerable!

Our server engineers here at Fool.com have pulled this script and set it up on systems external to our network (along with other testing scripts as well) and we have confirmed that we are no longer vulnerable...Please update this list accordingly, thank you!

Check does not differentiate between OpenSSL and other implementations

For example Stackoverflow is not built on top of OpenSSL: http://meta.stackoverflow.com/questions/10369/which-tools-and-technologies-are-used-to-build-the-stack-exchange-network

need python3 version

it need to be updated to python3

Python3 version for this script

login domains

Just because the main domain is safe does not mean the domain they use for their logins/secure area is safe.

Licsense

This repo does not have a license. Can you please add one?
GPL-v2 is good for humanity :-D

version alert

the script should modify it's heartbeat request packet to match the server's version, otherwise the server will anser with an 'protocol_version' alertpacket.

in that case the script will not actually have checked for the heartbleed bug.

Only "second level domain" is tested

Hi,

your test only runs again SLDs, on which we for example (immobilienscout24.de) don't have SSL running. Our www.immobilienscout24.de is capable of SSL (and not vulnerable). I guess there are quite a few other domains which also are listed as "no SSL", but do have SSL enabled on subdomains.

python3

python3 --version
Python 3.2.3
python3 ssltest.py
File "ssltest.py", line 65
except Exception, e:
^