关键词: 安全套接层协议（SSL）, OpenSSL, HeartBleed漏洞, 漏洞检测, 软件安全开发

Abstract: HeartBleed is a critical security vulnerability. The source code of HeartBeat in OpenSSL is analyzed and the cause of HeartBleed vulnerability is summarized. Then using Python, the vulnerability detection script tool is accomplished. The tool sends heartbeat packet whose data’s length is inconsistent with the value of length field. According to the values of type field and length field in response packet, the tool determines whether the target has HeartBleed vulnerability. The experiments which use this tool to detect Web websites and Web services applying OpenSSL are achieved. Compared with other detection tools for HeartBleed, the proposed detection tool has a wild detection range, rapid detection time and high accuracy rate. The tool can work effectively for HeartBleed vulnerability detection.

Key words: Secure Sockets Layer（SSL） security protocol, OpenSSL, HeartBleed vulnerability, vulnerability detection, security development of software