I'd like to compile and install a Heartbleed-vulnerable OpenSSL version on a server I'm setting up for a team web security challenge (since these are not available for install from Ubuntu's repository for obvious reasons).
I downloaded and compiled from source OpenSSL 1.0.1f using the provided instructions (run ./config
, then make
and make install
), and tried to run the openly available Heartbleed POC from GitHub from my PC, however the script is notfying me that no heartbeat response has been received and the server is likely not vulnerable.
Running openssl version
produces the following output: OpenSSL 1.0.1f 6 Jan 2014. I installed an SSL certificate of course and SSL access works on the server.
OpenSSL is installed to work with Apache 2.4.7.
Can anyone help?