Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related links

1. Hacker Security Tools
2. Hacker Tools List
3. Hacker Tools Github
4. Hacker Tools Software
5. Hacker Hardware Tools
6. What Is Hacking Tools
7. What Are Hacking Tools
8. Bluetooth Hacking Tools Kali
9. Pentest Tools For Mac
10. Pentest Tools Bluekeep
11. Hacking Tools Kit
12. Top Pentest Tools
13. Hack Tools Download
14. New Hacker Tools
15. Hacking Tools Software
16. Hacker Techniques Tools And Incident Handling
17. Hacking Tools Windows 10
18. Hack Apps
19. Hacker Tools Apk Download
20. Hacking Tools
21. Pentest Tools For Mac
22. Game Hacking
23. Hacker
24. Github Hacking Tools
25. Hacking Tools And Software
26. Hacking Tools Download
27. Hacking Tools For Mac
28. Hacker Tools Github
29. Tools For Hacker
30. Free Pentest Tools For Windows
31. Best Hacking Tools 2019
32. Hacker Hardware Tools
33. Hacking Tools For Pc
34. Hacker Tools 2019
35. Pentest Tools Kali Linux
36. Pentest Tools Windows
37. Hacker Tools Free Download
38. Top Pentest Tools
39. How To Install Pentest Tools In Ubuntu
40. Kik Hack Tools
41. Hacking Tools Name
42. New Hack Tools
43. Hacking Tools 2019
44. Free Pentest Tools For Windows
45. Hacking Tools For Games
46. Hacking Tools 2020
47. Hacking Tools
48. Best Hacking Tools 2020
49. Tools Used For Hacking
50. Hacker Tools Software
51. Hacking Tools 2019
52. Hacker Tools Free
53. Bluetooth Hacking Tools Kali
54. Bluetooth Hacking Tools Kali
55. Pentest Tools Kali Linux
56. Hacker Tools For Mac
57. Hacking Tools Software
58. Hacking Tools Software
59. Pentest Tools Windows
60. Pentest Tools Url Fuzzer
61. Hacker Tools Github
62. Hacker Search Tools
63. Nsa Hack Tools Download
64. Nsa Hack Tools
65. Hacker Tools For Windows
66. Hack Tools 2019
67. Hacker Tools 2019
68. Pentest Tools Port Scanner
69. Hacking Tools For Beginners
70. Beginner Hacker Tools
71. Hacker Tools Online
72. Hacker Tools Windows
73. Nsa Hack Tools Download
74. Pentest Tools Subdomain
75. Hack Tools For Games
76. Hacking Tools For Windows Free Download
77. Pentest Tools Apk
78. Hacking Tools For Mac
79. Pentest Tools List
80. Hacking Tools Software
81. Pentest Tools Nmap
82. Hacker Tools Software
83. Physical Pentest Tools
84. Hack Website Online Tool
85. Pentest Tools Online
86. Hak5 Tools
87. Hacking Tools Windows
88. Hack App
89. Hacking Tools Kit
90. Android Hack Tools Github
91. Pentest Tools Online
92. Nsa Hack Tools
93. Growth Hacker Tools
94. New Hack Tools
95. Hacker Tools Apk Download
96. Hack Tools For Ubuntu
97. New Hack Tools
98. Pentest Tools
99. Nsa Hacker Tools
100. Hacking Tools 2020
101. Hacking Tools Windows 10
102. Hacking Tools Free Download
103. Wifi Hacker Tools For Windows
104. Nsa Hacker Tools
105. Pentest Tools Windows
106. Hacking Tools And Software
107. Hacker Tools Free Download
108. Best Hacking Tools 2020
109. Hacking Tools Kit
110. Hack And Tools
111. Hack Tools For Windows
112. Bluetooth Hacking Tools Kali
113. Pentest Tools Free
114. Pentest Tools Android
115. Hack Website Online Tool
116. Pentest Recon Tools
117. Pentest Tools For Ubuntu
118. Pentest Tools Online
119. Pentest Tools Kali Linux
120. Computer Hacker
121. Top Pentest Tools
122. Pentest Tools Website Vulnerability