hands-on lab

OWASP Exercises: Exploiting the Heartbleed Bug

Up to 1h
Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.
Learn and validateUse validations to check your solutions every step of the way.
See resultsTrack your knowledge and monitor your progress.
Lab description

The Heartbleed bug is a serious vulnerability that was found to exist on webservers using the OpenSSL cryptographic library, a popular implementation of the TLS protocol for webservers. This exploit will work on any unpatched webservers running an OpenSSL instance in either client or server mode. The vulnerability was disclosed in 2014, although the bug was found to have been present since a software patch in September 2012. It allows attackers to perform a buffer overflow attack, where they can read more information than they should be allowed to and can, therefore, read the entire contents of a webserver's memory buffer - an area where the server stores data ready for processing or that is yet to be overwritten by other processes. This could include passwords, key strings, hashes and all manner of other sensitive information that other users are inputting onto the server during normal use.

In this lab, you will perform the Heartbleed attack using the MetaSploit Framework in order to dump the contents of a vulnerable webserver using an unpatched version of OpenSSL.

Learning Objectives

Upon completion of this lab you will be able to:

  • Set up MetaSploit to exploit a server vulnerable to Heartbleed attacks

Intended Audience

This lab is intended for:

  • Individuals who want to learn how to defend their servers against Heartbleed attacks
  • Security engineers who want to understand whether their servers are vulnerable to attacks
  • Individuals who want to understand how a Heartbleed attack is performed on a server


This lab has no prerequisites.


September 21st, 2021 - Updated HyperV VMs to not used save state to avoid an issue with Azure VMs in the same SKU not all having the same processor features

September 7th, 2021 - Upgraded underlying disk, and Kali Hyper-V VM configuration for improved performance

July 9th, 2020 - Enabled direct browser RDP connection for a streamlined experience

About the author
Richard Beck, opens in a new tab
Director of Cyber Security at QA
Learning paths

Richard Beck is Director of Cyber Security at QA. He works with customers to build effective and successful security training solutions tailored for business needs. Richard has over 15 years' experience in senior Information Security roles. Prior to QA, Richard was Head of Information Security for an organization that underpins 20% of the UK's Critical National Infrastructure. Richard also held Security and Technical Management posts in the Defence, Financial Services, and HMG. Richard sits on a number of security advisory panels and previously chaired the Communication Industry Personnel Security Information Exchange (CPNI). Richard is also a STEM Ambassador working to engage and enthuse young people in the area of cybersecurity. Providing a unique perspective on the world of cybersecurity to teachers and encourage young people to consider a career in cybersecurity.

Covered topics
Lab steps
Load the Virtual Machines (Kali & Heartbleed)
Navigate to the Victim Website
Test to Confirm the Webserver is Vulnerable
Create Data to Extract from the Server
Configure MetaSploit to Exploit the Heartbleed Server
Exploit the Heartbleed Server