Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related news

1. Free Pentest Tools For Windows
2. Github Hacking Tools
3. Hacker
4. Hacking Tools 2020
5. Black Hat Hacker Tools
6. Hack And Tools
7. Hacker Tools Mac
8. Hack Tools
9. Hacker Tools
10. Top Pentest Tools
11. Hackrf Tools
12. How To Install Pentest Tools In Ubuntu
13. Tools For Hacker
14. Hacking Tools For Kali Linux
15. Pentest Tools Android
16. Pentest Tools Bluekeep
17. Blackhat Hacker Tools
18. Ethical Hacker Tools
19. Hack Tools For Windows
20. What Are Hacking Tools
21. Pentest Recon Tools
22. Bluetooth Hacking Tools Kali
23. Game Hacking
24. Nsa Hack Tools Download
25. Hacker Tools Free Download
26. Hacking Tools 2019
27. Pentest Tools
28. Hacking Apps
29. New Hacker Tools
30. Hack Tools Mac
31. Pentest Tools Github
32. Hacking Tools Mac
33. Pentest Tools Subdomain
34. Best Hacking Tools 2020
35. Hacker Tools For Ios
36. Hacker Tools List
37. Hacking Tools For Beginners
38. Hacking Apps
39. Beginner Hacker Tools
40. Easy Hack Tools
41. Hacker Hardware Tools
42. Hacker Tools 2020
43. Pentest Tools Url Fuzzer
44. Hacker Tools Apk
45. Hacking Tools Windows
46. Hacker Tools Online
47. Hacker Tools Free
48. What Are Hacking Tools
49. Best Pentesting Tools 2018
50. Hacker Tools Github
51. Hacker Tools Online
52. Hacking Tools Download
53. Hacker Security Tools
54. Hacker Security Tools
55. Hack Tools 2019
56. Pentest Recon Tools
57. Hacker Tools Windows
58. Hack Rom Tools
59. Pentest Tools For Ubuntu
60. Hacker Tools Free Download
61. Bluetooth Hacking Tools Kali
62. Hacking Tools For Mac
63. Hacker Tools List
64. Pentest Tools For Ubuntu
65. Computer Hacker
66. Hacking Tools For Mac
67. Pentest Tools Framework
68. Hacking Tools Mac
69. Hacking Tools For Pc
70. Tools 4 Hack
71. Hacker
72. Hacker Tools Linux
73. Hacker Tools Free
74. Pentest Tools Website Vulnerability
75. Bluetooth Hacking Tools Kali
76. Nsa Hack Tools Download
77. Hacker Tools Mac
78. Hacking Tools Download
79. Hacker Techniques Tools And Incident Handling
80. Pentest Recon Tools
81. Pentest Tools Url Fuzzer
82. Blackhat Hacker Tools
83. Pentest Tools Review
84. Hacking Tools Name
85. Hacker
86. Pentest Tools Framework
87. Hack Tools Download
88. Hacking Tools For Pc
89. Hacker Tools Windows
90. Pentest Tools Bluekeep
91. Pentest Box Tools Download
92. Hacker Tools For Windows
93. Tools For Hacker
94. Blackhat Hacker Tools
95. Easy Hack Tools
96. Pentest Tools List
97. Nsa Hack Tools
98. Hack Tools Online
99. Hacker Search Tools
100. Android Hack Tools Github
101. Hacking Tools Software
102. Black Hat Hacker Tools
103. Hacking Tools Online
104. Hack Tools For Mac
105. Hack Tools For Mac
106. Hacker Tools Linux
107. Hack Tools Pc
108. Hack Tools Download
109. Pentest Tools Github
110. Hacker
111. Hak5 Tools
112. Beginner Hacker Tools
113. Pentest Tools Review
114. Hacking Tools For Windows
115. Hacking Tools Name
116. New Hacker Tools
117. Hacking Tools For Kali Linux
118. Kik Hack Tools
119. Hacker Tools Free
120. Top Pentest Tools
121. Tools For Hacker
122. New Hacker Tools