Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related articles

1. Hack Tool Apk No Root
2. Hacker Search Tools
3. Pentest Tools For Windows
4. Pentest Tools Find Subdomains
5. Hacking Tools Pc
6. Hacker Tools 2020
7. Ethical Hacker Tools
8. Hack Tools Online
9. Android Hack Tools Github
10. Hack Tools For Ubuntu
11. Pentest Tools For Ubuntu
12. Hacker Search Tools
13. Best Hacking Tools 2019
14. Hacking Tools Windows
15. Pentest Tools Kali Linux
16. Hacker Tools Mac
17. Pentest Tools Github
18. Install Pentest Tools Ubuntu
19. Hacker Tools Free Download
20. Hack Tools Github
21. Kik Hack Tools
22. Best Pentesting Tools 2018
23. Bluetooth Hacking Tools Kali
24. Hack Tools
25. Hack Tools Pc
26. Pentest Tools
27. Hacker Tools Windows
28. Hack Tools For Games
29. Hacking Tools
30. Pentest Tools For Ubuntu
31. Pentest Tools Port Scanner
32. Computer Hacker
33. Pentest Tools For Mac
34. Hacker
35. Pentest Tools List
36. Hacking Tools
37. Physical Pentest Tools
38. World No 1 Hacker Software
39. New Hack Tools
40. Hacker Hardware Tools
41. Pentest Tools For Ubuntu
42. Pentest Tools Find Subdomains
43. Hacking Tools Kit
44. Hacking Tools For Mac
45. Growth Hacker Tools
46. Hack Rom Tools
47. Pentest Tools Port Scanner
48. Pentest Reporting Tools
49. Pentest Recon Tools
50. Hacker Tools Online
51. Hacker Techniques Tools And Incident Handling
52. Pentest Tools Apk
53. Hackers Toolbox
54. Hackers Toolbox
55. Bluetooth Hacking Tools Kali
56. Beginner Hacker Tools
57. Pentest Tools For Ubuntu
58. How To Install Pentest Tools In Ubuntu
59. Beginner Hacker Tools
60. Blackhat Hacker Tools
61. Hacker Tools Linux
62. Tools For Hacker
63. Pentest Tools Port Scanner
64. Hack And Tools
65. Hack Tools Pc
66. Hacking Tools 2020
67. New Hack Tools
68. Hacking Tools Windows 10
69. Black Hat Hacker Tools
70. Hacker Tools Apk
71. Tools For Hacker
72. Hacking Tools Online
73. Hacking Tools Windows 10
74. Usb Pentest Tools
75. Hack Tools For Games
76. Hack Tools For Pc
77. Nsa Hack Tools Download
78. Pentest Tools Github
79. Install Pentest Tools Ubuntu
80. Hacking Tools For Mac
81. What Are Hacking Tools
82. What Is Hacking Tools
83. Underground Hacker Sites
84. Tools Used For Hacking
85. How To Make Hacking Tools
86. What Are Hacking Tools
87. Hacking Tools Windows
88. Hack Tools For Ubuntu
89. Hacker Tools
90. Hacker Tools For Windows
91. Tools For Hacker
92. Hacker Tools 2020
93. Game Hacking
94. Pentest Tools Review
95. Hack Tool Apk
96. How To Make Hacking Tools
97. Hacking Tools Github
98. Hacker Tools Free