Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related links

1. Pentest Tools Windows
2. Nsa Hack Tools Download
3. Install Pentest Tools Ubuntu
4. Pentest Tools Framework
5. Hacking Tools Mac
6. Hacking Tools And Software
7. Hack Tools
8. Beginner Hacker Tools
9. Hack Tools
10. Hacker Tools Software
11. Hacking Tools Windows 10
12. Hacking Tools For Windows Free Download
13. Hack Website Online Tool
14. Best Hacking Tools 2019
15. Pentest Tools Website Vulnerability
16. Pentest Tools Nmap
17. Pentest Tools Website
18. Nsa Hacker Tools
19. Hacking Tools Free Download
20. Hacking Tools Name
21. Nsa Hack Tools
22. How To Make Hacking Tools
23. Pentest Tools For Mac
24. Pentest Box Tools Download
25. Pentest Tools Windows
26. Usb Pentest Tools
27. Pentest Recon Tools
28. Pentest Automation Tools
29. Hacker Tools Free
30. Nsa Hack Tools Download
31. Hacking Tools
32. Hacker Tools Free
33. Best Pentesting Tools 2018
34. Pentest Tools Online
35. Hacker Tools For Pc
36. Pentest Tools Subdomain
37. Hackers Toolbox
38. Hacker
39. Hack Tool Apk
40. Tools For Hacker
41. Top Pentest Tools
42. Hacker Tools Free
43. Hacking Tools Usb
44. Hacker Tools Apk Download
45. Nsa Hacker Tools
46. Hacker Tools Apk
47. Hacking Tools Software
48. Hack Tools 2019
49. Black Hat Hacker Tools
50. Pentest Tools For Android
51. Pentest Tools For Windows
52. Hak5 Tools
53. Pentest Tools Free
54. Bluetooth Hacking Tools Kali
55. Free Pentest Tools For Windows
56. Pentest Automation Tools
57. Pentest Box Tools Download
58. Hacker Tool Kit
59. Hacker Hardware Tools
60. Hacking Tools Kit
61. Wifi Hacker Tools For Windows
62. Kik Hack Tools
63. Hacking Tools Windows 10
64. Hack Tools
65. Pentest Tools Free
66. Pentest Tools Free
67. Hacker Security Tools
68. Pentest Tools Framework
69. Github Hacking Tools
70. Hacker Tools 2019
71. How To Install Pentest Tools In Ubuntu
72. Kik Hack Tools
73. Pentest Box Tools Download
74. Pentest Tools Subdomain
75. Hack And Tools
76. Hack Tools For Ubuntu
77. Hack Tools Github
78. Pentest Tools List
79. Hack Tool Apk
80. Hak5 Tools
81. Hacking Tools Usb
82. Pentest Recon Tools
83. Beginner Hacker Tools
84. Hacking Tools For Kali Linux