Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related links

1. How To Install Pentest Tools In Ubuntu
2. Usb Pentest Tools
3. Hacking Tools Mac
4. Hack Tool Apk
5. Hacking Tools Kit
6. Easy Hack Tools
7. Github Hacking Tools
8. Pentest Tools Nmap
9. Hack Tool Apk No Root
10. Hacker Tools Apk
11. Hacker Tools 2020
12. Nsa Hack Tools
13. How To Install Pentest Tools In Ubuntu
14. Hack Tools Pc
15. Best Pentesting Tools 2018
16. Pentest Tools Online
17. Hacking Tools Windows 10
18. Pentest Tools Nmap
19. Hacking App
20. Pentest Tools For Ubuntu
21. Hacker Tools For Mac
22. New Hack Tools
23. Pentest Tools Online
24. Hacker Tools Linux
25. Beginner Hacker Tools
26. Hacking Tools For Windows Free Download
27. Hacking Tools Name
28. Hack Tools
29. How To Hack
30. Pentest Tools Port Scanner
31. Hacker
32. Underground Hacker Sites
33. Hacking Tools 2019
34. Underground Hacker Sites
35. Pentest Tools For Android
36. Hack Tools For Windows
37. Hacking Tools Github
38. Tools 4 Hack
39. How To Make Hacking Tools
40. Pentest Tools Framework
41. Easy Hack Tools
42. Hacking Tools Online
43. New Hack Tools
44. Hacking Tools For Beginners
45. Pentest Tools For Windows
46. Best Hacking Tools 2020
47. Hack Tools For Windows
48. Top Pentest Tools
49. Pentest Tools Website Vulnerability
50. Hacker Tools Windows
51. Pentest Tools Alternative
52. Hacking Tools Download
53. Hack App
54. Hacking Tools Windows
55. Hack Rom Tools
56. Hacker Tools Free
57. Pentest Tools Apk
58. Ethical Hacker Tools
59. Pentest Tools Apk
60. Pentest Tools Port Scanner
61. Pentest Tools Review
62. Best Hacking Tools 2020
63. Hacking App
64. Underground Hacker Sites
65. New Hacker Tools
66. Pentest Tools Website Vulnerability
67. Hacker Tools Free Download
68. Hacker Hardware Tools
69. Pentest Tools Windows
70. Ethical Hacker Tools
71. New Hacker Tools
72. Pentest Tools Bluekeep
73. Hacking Tools Github
74. Bluetooth Hacking Tools Kali
75. Pentest Automation Tools
76. Hacking Tools Online
77. Hacker Tools Apk Download
78. Pentest Tools Subdomain
79. Hack Tools 2019
80. Hacks And Tools
81. Android Hack Tools Github
82. Termux Hacking Tools 2019
83. Tools Used For Hacking
84. Kik Hack Tools
85. Pentest Tools For Mac
86. Hacking Tools Kit
87. Best Hacking Tools 2019
88. Hacker Tools List
89. Hacker Tools 2020
90. Hacker Tools Mac
91. Pentest Tools Online
92. Hacking Tools Mac
93. Hacking Tools And Software
94. Growth Hacker Tools
95. Hacker Tools List
96. Underground Hacker Sites
97. What Is Hacking Tools
98. Hacker Tools For Pc
99. Tools 4 Hack
100. Hack Tools For Ubuntu