Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

Related links

1. Pentest Tools Github
2. Pentest Recon Tools
3. Hacking Tools Free Download
4. Hacker Tool Kit
5. Pentest Tools Nmap
6. Hack Tool Apk
7. Hack Tools
8. Ethical Hacker Tools
9. Hacker Tools Linux
10. Hack Tools
11. Hacking Tools Windows
12. Hacking Tools Windows
13. Hack Apps
14. Hack App
15. Hack Tools Download
16. Pentest Box Tools Download
17. Game Hacking
18. Physical Pentest Tools
19. Hack Tools
20. Hacker Tools For Windows
21. Hacking Tools For Beginners
22. Hack Tools For Games
23. Hack Tools Pc
24. Bluetooth Hacking Tools Kali
25. Hack Tools Mac
26. Pentest Tools
27. World No 1 Hacker Software
28. World No 1 Hacker Software
29. Hacker Tools For Mac
30. Pentest Tools Framework
31. Pentest Automation Tools
32. Hacking Tools For Games
33. Pentest Tools Nmap
34. Black Hat Hacker Tools
35. Hack Tools For Games
36. Hack Tool Apk
37. Best Pentesting Tools 2018
38. How To Make Hacking Tools
39. Hacking Tools For Mac
40. Hacker Security Tools
41. Pentest Tools Kali Linux
42. Install Pentest Tools Ubuntu
43. Hak5 Tools
44. Hacker Tools Free Download
45. Pentest Box Tools Download
46. Hack Tools For Mac
47. Best Hacking Tools 2020
48. Tools Used For Hacking
49. Hacker Tools Hardware
50. Hacking Tools Mac
51. Pentest Tools Kali Linux
52. Ethical Hacker Tools
53. Tools 4 Hack
54. Pentest Tools Apk
55. Pentest Tools Apk
56. Bluetooth Hacking Tools Kali
57. Hacking Tools And Software
58. Hacks And Tools
59. Hacking Tools For Windows
60. Pentest Box Tools Download
61. Kik Hack Tools
62. Hacking Tools Online
63. Hack Tools For Ubuntu
64. Pentest Tools For Mac
65. Game Hacking
66. Hacker Tools 2019
67. Pentest Tools Android
68. What Are Hacking Tools
69. Hack Tools Download
70. New Hacker Tools
71. Hack Tools Mac
72. Hacker Hardware Tools
73. Hack Tools For Ubuntu
74. How To Make Hacking Tools
75. Hack Rom Tools
76. Hacker Hardware Tools
77. Pentest Tools Apk
78. Hacker Tools Hardware
79. Hacking Tools Hardware
80. Hacking Tools Hardware
81. Hacking Tools For Windows Free Download
82. Growth Hacker Tools
83. Pentest Tools Download
84. Hacker Tools
85. Best Pentesting Tools 2018
86. Growth Hacker Tools
87. Pentest Tools Url Fuzzer
88. Hacker Techniques Tools And Incident Handling
89. Pentest Automation Tools
90. Hack Tools For Games
91. Hacker Tools Apk Download
92. Hacker Tool Kit
93. Hack Tools Pc
94. Install Pentest Tools Ubuntu
95. Pentest Tools List
96. Hacking Tools For Mac
97. Easy Hack Tools
98. How To Make Hacking Tools
99. Hacker Tools List
100. Tools For Hacker
101. Pentest Tools For Android
102. Hack Tools
103. Hack Rom Tools
104. Underground Hacker Sites
105. Hacking Tools
106. Pentest Tools For Mac
107. Pentest Tools Website
108. Hacking Tools And Software
109. Best Hacking Tools 2019
110. Hackers Toolbox
111. Hack Tool Apk
112. Hacker Tools For Windows
113. Pentest Tools Review
114. Pentest Tools Github
115. Hack Rom Tools
116. Hacker Tools 2019
117. Hacking Tools Mac
118. Pentest Recon Tools
119. Hacker Security Tools
120. Physical Pentest Tools
121. Hacking Tools For Kali Linux
122. Hacking Tools Name
123. Hacker Tools Free Download
124. Black Hat Hacker Tools
125. Hacker Techniques Tools And Incident Handling
126. Tools Used For Hacking
127. Hacking Tools For Pc
128. Hacking App
129. Hack And Tools