Skip to content
Home

Heartbleed & Log4Shell: Detection

Nmap scripts to detect CVE-2014-0160 (Heartbleed) and CVE-2021-44228 (Log4Shell)

bash·1 min read··INE Certification

Two CVEs that appear constantly in vulnerability assessments. In practice the detection step is the one you run repeatedly; actual exploitation is highly environment-specific and lab/CTF-context dependent.

Heartbleed (CVE-2014-0160)

A TLS Heartbeat extension bug in OpenSSL ≤1.0.1f that lets a remote attacker read up to 64KB of the server’s process memory per request. This means private keys, session tokens, plaintext passwords, or whatever happens to be there.

nmap -sV --script ssl-heartbleed -p 443 <target>          # detect heartbleed
nmap -sV --script ssl-enum-ciphers -p <ssl_port> <target> # also shows accepted cipher suites/compressors

Log4Shell (CVE-2021-44228)

A JNDI lookup injection in Apache Log4j2 (2.0-beta9 through 2.14.1). Any user-controlled value that gets logged (headers, form fields, user-agents) can trigger an outbound LDAP request and execute arbitrary code. Fixed in 2.15.0 (and hardened further in 2.16.0).

nmap --script log4shell.nse \
  --script-args log4shell.callback-server=<your_callback_ip>:1389 \
  -p 8080 <target>