Heartbleed not detected

[ericrange]

Seems that the heartbleed plugin does not detect a heartbleed vuln. correctly.

example site: ascn.papasg.com

[nabla-c0d3]

Thanks - this was a timing issue.

[aronmolnar]

This is unfortunately again an issue.
Heartbleed and ccs injection are not detected correctly in version 2.0.6.

I can privatly share a vulnerable system with you if needed.

[nabla-c0d3]

@al3xdelarge can you send it to my email address (on my GH profile)? Thanks!

[aronmolnar]

Just sent it. Thank you!

[nabla-c0d3]

@al3xdelarge I finally looked into it. This was due to the server's TLS stack not supporting the Server Name Indication extension (or just rejecting any name sent via SNI).

Since SSLyze always sends the SNI extension, the server was always returning a TLS Alert 112 "unrecognized_name" (ie. rejecting the SNI extension's value), ending the TLS handshake before SSLyze could test for Heartbleed and CCS.

The fix I just committed was to remove the SNI extension from all checks (including Heartbleed and CCS) except the certificate_info check which requires it. With this changes, SSLyze correctly flags the server you sent me as vulnerable.

[nabla-c0d3]

Fixed in v3.0.3.