Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More information

1. Pentest Tools Windows
2. Pentest Reporting Tools
3. Underground Hacker Sites
4. Pentest Tools Website
5. Termux Hacking Tools 2019
6. Hacker Techniques Tools And Incident Handling
7. Hacking Tools Usb
8. Pentest Tools Tcp Port Scanner
9. New Hacker Tools
10. Pentest Tools Tcp Port Scanner
11. Hacking Tools Software
12. Hacker Tools Apk Download
13. Hackers Toolbox
14. Hacker Tools Mac
15. Hack Tools For Mac
16. Pentest Tools Framework
17. Best Hacking Tools 2019
18. Pentest Tools Website
19. Hack Apps
20. Hackrf Tools
21. Pentest Tools For Android
22. Hack Tool Apk No Root
23. Hacking Tools Mac
24. Hacking Tools For Kali Linux
25. Hack App
26. Install Pentest Tools Ubuntu
27. Hack Tool Apk
28. Pentest Tools Online
29. Github Hacking Tools
30. Hacking Tools For Beginners
31. Wifi Hacker Tools For Windows
32. Hacking Tools Usb
33. How To Hack
34. Pentest Box Tools Download
35. How To Install Pentest Tools In Ubuntu
36. Nsa Hack Tools Download
37. Best Hacking Tools 2019
38. Tools 4 Hack
39. Hackrf Tools
40. Hacker Tools Windows
41. Hacker Tools For Ios
42. Tools Used For Hacking
43. Tools Used For Hacking
44. Hacker Security Tools
45. Pentest Tools Windows
46. Pentest Tools Website Vulnerability
47. Hacking Tools For Games
48. Hacking Tools For Kali Linux
49. Nsa Hacker Tools
50. Hacking Tools For Pc
51. Hacker Security Tools
52. Beginner Hacker Tools
53. What Is Hacking Tools
54. Hacker Tools Linux
55. Growth Hacker Tools
56. Bluetooth Hacking Tools Kali
57. Termux Hacking Tools 2019
58. Pentest Tools Tcp Port Scanner
59. Hacking Tools Name
60. Hacking Tools Usb
61. Hacker Tools For Pc
62. Hackers Toolbox
63. Tools Used For Hacking
64. Best Pentesting Tools 2018
65. Hacking Tools Free Download
66. Nsa Hack Tools Download
67. Hack Tool Apk
68. Hacking Tools For Windows Free Download
69. Pentest Tools Open Source
70. Hacking Tools Online
71. Hacker Tools 2020
72. Growth Hacker Tools
73. Tools Used For Hacking
74. Hack Tools Online
75. Hacking Tools 2020
76. Hack Tools For Ubuntu
77. Blackhat Hacker Tools
78. Tools 4 Hack
79. Pentest Tools Alternative
80. Hacker Tools Free Download
81. Pentest Automation Tools
82. Hacking Tools For Kali Linux
83. Pentest Box Tools Download
84. Hacker Tools Hardware
85. Pentest Tools Kali Linux
86. Hacker Tools Online
87. Hacking Tools For Pc
88. Hacking Tools Github
89. Hacking Tools Hardware
90. Pentest Tools Website
91. Best Pentesting Tools 2018
92. Hack Tools Mac
93. Ethical Hacker Tools
94. Best Hacking Tools 2020
95. Bluetooth Hacking Tools Kali
96. Pentest Tools Kali Linux
97. Hacking Tools Windows
98. Pentest Tools Website Vulnerability
99. Hackrf Tools
100. Hacker Tools Free
101. Hacking Tools Free Download
102. Pentest Tools Windows
103. Hacking Tools Online
104. Android Hack Tools Github
105. Pentest Tools
106. Hacking Tools And Software
107. Hack Tool Apk
108. Hacking Tools For Pc
109. Nsa Hack Tools
110. Pentest Tools Free
111. Hack Tools 2019
112. Nsa Hacker Tools
113. Physical Pentest Tools
114. Hacks And Tools
115. What Are Hacking Tools
116. Tools 4 Hack
117. Hacking Tools Pc
118. Usb Pentest Tools