Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related news

1. Computer Hacker
2. Wifi Hacker Tools For Windows
3. Hack Tools
4. Tools 4 Hack
5. Free Pentest Tools For Windows
6. Install Pentest Tools Ubuntu
7. Hacking Tools For Windows
8. Hacker Tools Apk Download
9. Best Hacking Tools 2020
10. World No 1 Hacker Software
11. Ethical Hacker Tools
12. Pentest Tools Subdomain
13. Hacking Tools Github
14. Hack Tools 2019
15. Hacker Tools Apk Download
16. Pentest Tools Tcp Port Scanner
17. Growth Hacker Tools
18. Easy Hack Tools
19. Hacker Tools Hardware
20. Tools 4 Hack
21. Hacker Techniques Tools And Incident Handling
22. Pentest Tools Find Subdomains
23. Hackrf Tools
24. Physical Pentest Tools
25. Hacking Tools
26. Hacker Tools For Pc
27. Hacking Tools 2020
28. Underground Hacker Sites
29. Hacking Tools For Windows
30. New Hacker Tools
31. Free Pentest Tools For Windows
32. Pentest Box Tools Download
33. Usb Pentest Tools
34. Termux Hacking Tools 2019
35. Hacking Tools For Beginners
36. Pentest Tools Alternative
37. Best Hacking Tools 2019
38. Pentest Automation Tools
39. Hacking Tools Windows
40. Easy Hack Tools
41. Nsa Hacker Tools
42. Pentest Tools Nmap
43. Hacker Tools For Ios
44. Hacker Tools For Pc
45. Hak5 Tools
46. Hacker Tools Free Download
47. Nsa Hack Tools
48. Pentest Tools For Windows
49. Underground Hacker Sites
50. Pentest Tools Url Fuzzer
51. Hacker Tools For Windows
52. Pentest Tools Subdomain
53. Hacking Tools Windows 10
54. Hacker Tools 2019
55. Pentest Tools Alternative
56. Pentest Box Tools Download
57. Hacker Tools 2019
58. Hacking Tools Download
59. Best Hacking Tools 2019