Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related links

1. Hacking Tools For Kali Linux
2. Best Hacking Tools 2019
3. New Hacker Tools
4. Hack Tools For Games
5. Hacker Search Tools
6. Game Hacking
7. Hacker Tools For Pc
8. Hacking Tools Windows 10
9. Hacking Tools For Games
10. Hack Tools For Ubuntu
11. Hack Tools Download
12. Hacking Tools Online
13. Hack Tools 2019
14. Pentest Tools Nmap
15. Wifi Hacker Tools For Windows
16. Hack Tools For Pc
17. Hacking App
18. Pentest Tools Github
19. Hacker Techniques Tools And Incident Handling
20. Hack Tools Github
21. Hacker Tools For Ios
22. Hack Rom Tools
23. Hacking Tools 2020
24. Hack Tools Pc
25. Pentest Reporting Tools
26. Pentest Tools For Windows
27. Hacker Tools Hardware
28. Hacker Tools Github
29. Hack Tools Mac
30. What Is Hacking Tools
31. Pentest Reporting Tools
32. Bluetooth Hacking Tools Kali
33. Hacker Tools Windows
34. Hack And Tools
35. Blackhat Hacker Tools
36. Pentest Tools Alternative
37. Tools Used For Hacking
38. Pentest Tools Alternative
39. Tools For Hacker
40. Hacker Security Tools
41. Hacking Tools Kit
42. Pentest Tools Website
43. Hacking App
44. Best Hacking Tools 2019
45. Kik Hack Tools
46. Pentest Tools Nmap
47. Hacking Tools Name
48. Hacking Tools For Kali Linux
49. Hacker Tools Github
50. Hacking Tools Hardware
51. Hacker Tool Kit
52. Hacking App
53. Hacker Tools Linux
54. Pentest Tools Nmap
55. Pentest Tools Find Subdomains
56. Pentest Tools Online
57. What Are Hacking Tools
58. Hack Tools Pc
59. Pentest Tools Nmap
60. Nsa Hacker Tools
61. Hack App
62. Hacking Tools 2019
63. Hacking Tools And Software
64. Pentest Tools Port Scanner
65. Usb Pentest Tools
66. Hacker Tools Linux
67. Pentest Tools Online
68. Top Pentest Tools
69. Hacking Tools For Windows 7
70. Hack Website Online Tool
71. Pentest Tools For Ubuntu
72. Ethical Hacker Tools
73. Hacker Tools Mac
74. Best Hacking Tools 2019
75. Hack Tools Github
76. Hack And Tools
77. Pentest Tools For Windows
78. Hack Tool Apk No Root
79. Pentest Tools Linux
80. Hacking App
81. Hacker Tools Apk Download
82. Free Pentest Tools For Windows
83. Hackrf Tools
84. Hacking Tools Software
85. Pentest Tools Tcp Port Scanner
86. Top Pentest Tools
87. Pentest Tools Android
88. How To Make Hacking Tools
89. Hack Tools
90. Hacking Tools Windows
91. Hacker Tools For Mac
92. Hacking Tools For Beginners
93. Growth Hacker Tools
94. Pentest Tools For Mac
95. Usb Pentest Tools
96. Tools 4 Hack
97. Github Hacking Tools
98. Pentest Tools
99. Hacker Tool Kit