Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More information

1. Hacker Techniques Tools And Incident Handling
2. Hack Tool Apk
3. Tools For Hacker
4. Pentest Tools Open Source
5. Wifi Hacker Tools For Windows
6. Wifi Hacker Tools For Windows
7. Pentest Tools Github
8. Black Hat Hacker Tools
9. Usb Pentest Tools
10. Hack Tools For Ubuntu
11. Hacker
12. Hacking Tools And Software
13. How To Make Hacking Tools
14. Hacking Tools Pc
15. Pentest Tools List
16. Pentest Tools Open Source
17. Pentest Tools Download
18. Hacking Tools Pc
19. Pentest Tools For Ubuntu
20. Pentest Automation Tools
21. Android Hack Tools Github
22. Nsa Hacker Tools
23. Pentest Tools Website Vulnerability
24. Pentest Tools Free
25. Pentest Tools Free
26. Hacking Apps
27. Pentest Tools Github
28. Hacker Security Tools
29. Hacking Tools For Kali Linux
30. Hack Rom Tools
31. Hacker Tools For Windows
32. Hacker Security Tools
33. Hacking Tools Free Download
34. Beginner Hacker Tools
35. Hacking Tools Kit
36. Pentest Tools Website
37. World No 1 Hacker Software
38. Pentest Tools Find Subdomains
39. Hack Tools For Windows
40. Pentest Recon Tools
41. New Hack Tools
42. Pentest Tools Framework
43. Wifi Hacker Tools For Windows
44. Physical Pentest Tools
45. Pentest Tools
46. Pentest Tools Review
47. Top Pentest Tools
48. Hacking Tools Free Download
49. Pentest Tools Kali Linux
50. Pentest Tools For Ubuntu
51. Hacking Tools Windows 10
52. Pentest Tools Website Vulnerability
53. What Is Hacking Tools
54. Hacker Hardware Tools
55. Hacker Tools Online
56. Underground Hacker Sites
57. Pentest Tools Bluekeep
58. Pentest Tools Framework
59. Hak5 Tools