Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More articles

1. Growth Hacker Tools
2. Hacking Tools For Beginners
3. Hacking Tools Kit
4. Hack Tools For Mac
5. Hacker Tools
6. Pentest Tools Github
7. Best Hacking Tools 2020
8. Hacking Tools Pc
9. Hacker Tools For Mac
10. Hack Tools Online
11. Hack App
12. How To Hack
13. Computer Hacker
14. Nsa Hacker Tools
15. Hacker Tools Hardware
16. Nsa Hacker Tools
17. Hacker Tools For Mac
18. Hacking Tools Name
19. Best Pentesting Tools 2018
20. How To Make Hacking Tools
21. Hacking Tools For Windows Free Download
22. Hack Tools For Mac
23. Game Hacking
24. Hacking Tools Download
25. Hacker Tools 2020
26. Hacker Tools 2020
27. Pentest Tools Framework
28. Android Hack Tools Github
29. Bluetooth Hacking Tools Kali
30. Hacker Tools For Mac
31. Pentest Tools Website
32. Pentest Tools Find Subdomains
33. Hacker Tools Github
34. Hack Tools For Ubuntu
35. Blackhat Hacker Tools
36. Hack Tools Download
37. Hackrf Tools
38. Hack Tools For Ubuntu
39. Pentest Recon Tools
40. Hacker Hardware Tools
41. Pentest Tools Port Scanner
42. Hacking Tools For Windows 7
43. Pentest Tools
44. Hacking Tools Online
45. Install Pentest Tools Ubuntu
46. Bluetooth Hacking Tools Kali
47. Physical Pentest Tools
48. Hacker Tools
49. Hack Tools For Pc
50. Hacker Tools 2020
51. Pentest Tools Bluekeep
52. Pentest Tools Website Vulnerability
53. Underground Hacker Sites
54. Hacker Tools Github
55. Hack Rom Tools
56. Hacking Tools Name
57. Hack Tools Github
58. Hacking Tools Kit
59. Hacker Tools Windows
60. Hacker Tools Linux
61. Hacking Tools And Software
62. Hack Tool Apk
63. Hacker Security Tools
64. Pentest Tools Tcp Port Scanner
65. Termux Hacking Tools 2019
66. Best Hacking Tools 2020
67. Hack Tools Pc
68. Hacking Tools 2020
69. How To Install Pentest Tools In Ubuntu
70. Hacking Tools Pc
71. Pentest Tools Github
72. Hacker Tools Github
73. Hack Tools
74. Hacker Tools Apk Download
75. Kik Hack Tools
76. Hacking Tools Windows
77. Pentest Tools Github
78. Hacker
79. Pentest Tools Open Source
80. Hacking Tools Online
81. Hacks And Tools
82. Hacker Tools For Ios
83. Hackers Toolbox
84. Hacking Tools For Mac
85. Hacker
86. Black Hat Hacker Tools
87. Hack Tools
88. Pentest Tools Apk
89. Hacker Hardware Tools
90. Pentest Tools Download
91. Hack Tools Download
92. Hacker Tools Linux
93. Pentest Tools Port Scanner
94. Best Pentesting Tools 2018
95. Hack Tools
96. Tools Used For Hacking
97. Best Hacking Tools 2019
98. Pentest Reporting Tools
99. Hacking Tools Windows 10
100. Hacker Tools Software
101. Hack Tools For Ubuntu
102. Pentest Tools Website
103. Hacking Tools And Software
104. Hacking Tools Download
105. What Are Hacking Tools
106. Nsa Hack Tools
107. Hacking Tools And Software
108. Hacking Tools For Windows 7
109. Hack Tools
110. Hak5 Tools
111. Pentest Tools For Mac
112. Pentest Tools Apk
113. Hacking Tools Pc
114. Best Pentesting Tools 2018
115. Pentest Tools Subdomain
116. Pentest Tools Open Source
117. Pentest Tools List
118. New Hacker Tools
119. Pentest Tools Url Fuzzer
120. Hacker
121. Pentest Tools Windows
122. Hacker
123. Hacker Tools 2020
124. Pentest Tools Linux
125. How To Install Pentest Tools In Ubuntu
126. World No 1 Hacker Software
127. Hacker Tools
128. Easy Hack Tools
129. Hacker Tools Free Download
130. Best Pentesting Tools 2018
131. Hacker Tools Software
132. Pentest Tools Url Fuzzer
133. Hacker Search Tools
134. Hacking Tools Hardware
135. Hacker Tools List
136. What Is Hacking Tools
137. Hacking Tools Online
138. Hacker Tools For Mac
139. Hacker Tools Apk Download
140. Hacker Tools
141. Install Pentest Tools Ubuntu
142. Hacking Tools 2020
143. Kik Hack Tools
144. Pentest Tools Android
145. Hacker Tools List
146. Hack Tools For Mac
147. Pentest Tools Subdomain
148. Hacker Tools 2020
149. Hacker Tool Kit
150. Pentest Tools Online
151. Pentest Tools Linux
152. Hacking Tools For Windows 7
153. Pentest Tools Alternative
154. Hacker Tools For Ios
155. Hacking Tools Mac
156. Github Hacking Tools
157. Hacker Tools For Ios
158. Hacks And Tools