Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More articles

1. Pentest Tools Website
2. Pentest Tools Url Fuzzer
3. Hacker Hardware Tools
4. Nsa Hack Tools
5. Android Hack Tools Github
6. Hack Tools For Games
7. Pentest Tools Port Scanner
8. Hack Tools
9. Hacking Tools Usb
10. Hacking Tools For Windows 7
11. Hack Website Online Tool
12. Hacking Tools For Mac
13. Pentest Tools Framework
14. Hacker Tools For Ios
15. Hacker Tool Kit
16. Hacker Tools For Pc
17. Hack Tools Pc
18. Hacker Tools Mac
19. Hacker Tool Kit
20. Hack Tools 2019
21. Hacker Tools Github
22. Hacking Tools Windows 10
23. Hacking Tools Name
24. Physical Pentest Tools
25. Hacking Tools Free Download
26. Hack Tool Apk No Root
27. Hacking Apps
28. Hack Tools 2019
29. Pentest Tools Port Scanner
30. Hack Website Online Tool
31. Android Hack Tools Github
32. Pentest Tools Website Vulnerability
33. Hacker Tools Mac
34. Pentest Tools Website Vulnerability
35. Pentest Tools Bluekeep
36. Computer Hacker
37. Pentest Tools Website
38. Hacker Techniques Tools And Incident Handling
39. Hacking Tools 2020
40. Pentest Tools For Ubuntu
41. Best Pentesting Tools 2018
42. Hacker Tools Hardware
43. Hackrf Tools
44. New Hacker Tools
45. Hacking Tools For Games
46. Underground Hacker Sites
47. World No 1 Hacker Software
48. Best Pentesting Tools 2018
49. Pentest Box Tools Download
50. Hacking Tools
51. Hack Tools For Games
52. Top Pentest Tools
53. Hacking Tools Kit
54. Hack And Tools
55. Pentest Tools Android
56. Hacking App
57. Hacker Tools Windows
58. Hacking Tools Windows
59. New Hack Tools
60. Hacking Tools For Windows Free Download
61. Hacker Tools Windows
62. Hack Tools
63. Hacker Tools Apk Download
64. Hacker Tools Hardware
65. Hacking Tools Usb
66. Hacker Security Tools
67. Easy Hack Tools
68. Hacker Tools For Pc