[Tutorial] How To EXPLOIT HEARTBLEED (0day Vulnerable)

Hello ..today am gonna show you that how to exploit hearbleed vulnerability on web server 1) Kali linux 1.5 or above 2)setup apache2 server 3)using python script(for exploitation) step 1 : download the exploitation script from here https://gist.github.com/sh1n0b1/10100394 step 2: copy it to the leafpad and save it with .py eg : hb.py step 3: start apache server ( You have to do it after setup server on your machine using apache2) open the terminal type this without quotation 'service apache2 start' step 4: open the another terminal type python filename.py localhost address/ webserver address eg (hb.py localhost) step 5: thats all you could see the leaked information from your localhost for REAL TIME penetration , list of vulnerable web server are available in this link https://zmap.io/heartbleed/ though few servers are patched, still plenty of server are vulnerable... happy Hacking feel free to ask doubt regarding this exploitation Good script idea. But, do not test against third party sites without permission. On a side note, but still related. Are there any cloud services that would let me use their system to conduct security testing on my own site. As I am aware it is against the Terms of Service to even port scan using Amazon Web Services resources. type python filename.py localhost address/ webserver address meaning i have to type filename.py (mylocalhostaddress)/(website i want to hack).... is that right? Thank you filename.py targetaddress(or)targetwebservername eg) filename.py abc.com (or)10.10.10.10(ip address of abc.com) i dont think any cloud service provider would let you to pentest... @ GorroBlanco : hope it will be useful for you...cheers Thank you and nice share Thanks Author has referred Kali Linux , so in addition you can also use NMAP script for Vulnerability scanning for Heartbleed (OpenSSL Vulnerability) like; ~> nmap -sV -O -p 443 --script ssl-heartbleed (Target IP) If its Vulnerable against Heartbleed than use Metasploit for Exploitation like; msf > use auxiliary/scanner/ssl/openssl\_heartbleed Set the parameters and dont forget to enable verbose message. Thanks !