Monday, 24 August 2020

Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
More info
  1. Hacker Tools 2019
  2. Tools 4 Hack
  3. Hacking Tools Windows
  4. New Hack Tools
  5. Computer Hacker
  6. Pentest Tools Tcp Port Scanner
  7. Hacking Tools For Mac
  8. Kik Hack Tools
  9. Hacking Tools Software
  10. Hack Tools Download
  11. Pentest Tools Tcp Port Scanner
  12. Hack Apps
  13. Hacking Tools For Pc
  14. Pentest Tools Review
  15. Growth Hacker Tools
  16. World No 1 Hacker Software
  17. Hack Tools Online
  18. Best Hacking Tools 2020
  19. Pentest Tools Apk
  20. New Hack Tools
  21. Pentest Box Tools Download
  22. Hacker Tools List
  23. Pentest Tools For Windows
  24. Hacker Hardware Tools
  25. Pentest Tools
  26. Pentest Tools Framework
  27. Hacker Tools Online
  28. Tools Used For Hacking
  29. Pentest Tools Linux
  30. Hacking Tools Software
  31. Hacking Tools For Windows 7
  32. Pentest Tools Open Source
  33. Beginner Hacker Tools
  34. Hacker Tools Apk Download
  35. Pentest Tools Review
  36. Hacking Apps
  37. Hack Tools 2019
  38. Hacker Tools Online
  39. Hack Tools Mac
  40. Hacking Tools For Pc
  41. Hack Rom Tools
  42. New Hacker Tools
  43. Hack App
  44. Pentest Box Tools Download
  45. New Hacker Tools
  46. Computer Hacker
  47. Beginner Hacker Tools
  48. Hack Tools Download
  49. Hacker Tools Software
  50. Hacker Hardware Tools
  51. Pentest Tools Bluekeep
  52. Hack Tools Download
  53. Hack Tools Github
  54. Growth Hacker Tools
  55. Pentest Tools List
  56. Hacker Tools For Mac
  57. Pentest Tools Url Fuzzer
  58. Pentest Tools Free
  59. Hacking Tools Windows 10
  60. Blackhat Hacker Tools
  61. Black Hat Hacker Tools
  62. Hacker Tools For Windows
  63. Hack Rom Tools
  64. Hacker Tools Apk
  65. Hacker Tools For Windows
  66. Hacking App
  67. Pentest Tools For Android
  68. Hacker Tools For Pc
  69. Pentest Tools Apk
  70. Hacker Tools Free Download
  71. Pentest Tools Windows
  72. Pentest Tools Url Fuzzer
  73. Hacking Tools For Windows Free Download
  74. Hacking Tools Online
  75. Hacking Tools Hardware
  76. Physical Pentest Tools
  77. What Is Hacking Tools
  78. Game Hacking
  79. Nsa Hack Tools Download
  80. Termux Hacking Tools 2019

No comments:

Post a Comment