Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More info

1. Underground Hacker Sites
2. Hacker Search Tools
3. Hacker Hardware Tools
4. Hack Tool Apk No Root
5. Hacker
6. Hacker
7. Pentest Tools For Mac
8. Best Pentesting Tools 2018
9. Pentest Tools Review
10. Usb Pentest Tools
11. Pentest Tools Review
12. Black Hat Hacker Tools
13. Github Hacking Tools
14. Hack Tools Online
15. Hacker Tools Mac
16. Hacking Apps
17. Android Hack Tools Github
18. World No 1 Hacker Software
19. Hacking Tools For Games
20. Hacking Tools Online
21. Hack Tool Apk
22. Pentest Tools Download
23. Hack Tools
24. Kik Hack Tools
25. Hacking Tools Mac
26. Pentest Tools
27. Nsa Hacker Tools
28. Hack Tools Online
29. Wifi Hacker Tools For Windows
30. Hacker Tools 2020
31. Hack Apps
32. Hack Tools For Ubuntu
33. Pentest Tools For Mac
34. Game Hacking
35. Hack App
36. Hacking Tools For Pc
37. Top Pentest Tools
38. Pentest Tools Download
39. Hacker Tools For Ios
40. Pentest Tools Framework
41. Nsa Hacker Tools
42. Hacking Tools For Windows 7
43. Pentest Tools Kali Linux
44. Hacking Apps
45. Pentest Tools
46. Pentest Tools Linux
47. Hacking Tools Online
48. Physical Pentest Tools
49. Nsa Hack Tools Download
50. Hacking Tools
51. Hacks And Tools
52. Pentest Tools List
53. Hacker Tools Online
54. Hacker Tools For Mac
55. New Hack Tools
56. Underground Hacker Sites
57. New Hacker Tools
58. Hacker Tools Software
59. How To Install Pentest Tools In Ubuntu
60. World No 1 Hacker Software
61. Hacking Tools Github
62. Pentest Tools For Mac
63. Hacker Tools List
64. Hacking Tools
65. Install Pentest Tools Ubuntu
66. Hacker Tools For Pc
67. How To Make Hacking Tools
68. Hacker Search Tools
69. Hack Tools For Games
70. Hack Tools For Pc
71. Underground Hacker Sites
72. Physical Pentest Tools
73. Hacking Tools Hardware
74. Pentest Tools
75. Hacker Tools Software
76. Pentest Tools Find Subdomains
77. Tools Used For Hacking
78. Hack Tools 2019
79. Hacking Tools Hardware
80. Hacker
81. Hacking Tools Download
82. Hack Tools For Mac
83. Pentest Tools Review
84. Hacking Tools Name
85. Pentest Tools Download
86. Pentest Automation Tools
87. Hacks And Tools
88. Pentest Tools Github
89. Hacker Tools 2020
90. Hack Tools Pc
91. Hak5 Tools
92. Pentest Tools For Windows
93. Hacking Tools 2020
94. Pentest Tools Find Subdomains
95. Pentest Automation Tools
96. Pentest Tools Bluekeep