Scanning TLS Server Configurations With Burp Suite
In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.
You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases
Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner. The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).
It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.
Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.
This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget. The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).
If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.
You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases
TLS-Scanner
Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned. After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration. Basic tests check the supported cipher suites and protocol versions. In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.
Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner. The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).
It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.
Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.
Scan History
If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.
Additional functions will follow in later versions
Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget. The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).
If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
More information
- Termux Hacking Tools 2019
- Pentest Tools Port Scanner
- Hacking Tools For Mac
- New Hack Tools
- Hacking Tools
- Pentest Tools Framework
- Hack Tools Online
- Pentest Tools Download
- Hacking Tools
- Pentest Tools Kali Linux
- World No 1 Hacker Software
- Hacker Tools Apk
- Hacking Tools Free Download
- Pentest Tools Tcp Port Scanner
- Hack Tools For Pc
- Hacker Tools Mac
- Install Pentest Tools Ubuntu
- Hacker Tools Apk Download
- Hack Tools For Windows
- Hacker Tools For Ios
- Hackers Toolbox
- Hacker Tools For Ios
- Pentest Recon Tools
- Pentest Tools Alternative
- Growth Hacker Tools
- Pentest Tools For Android
- Pentest Tools Apk
- Tools 4 Hack
- Hacking Tools For Beginners
- Hacking Tools 2020
- Hacking Tools 2019
- Hacker Search Tools
- Hacking Tools For Mac
- Hacker Tools For Windows
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Mac
- Tools For Hacker
- Pentest Tools Url Fuzzer
- Easy Hack Tools
- Hack Apps
- Easy Hack Tools
- Hacker Tools 2020
- Hacking App
- Hacking Tools Mac
- Ethical Hacker Tools
- Pentest Tools Website
- Hacking Tools For Beginners
- Hack Tools
- Hacker Security Tools
- Pentest Tools Find Subdomains
- Hack Apps
- Hacking Tools 2020
- Hackers Toolbox
- Hacker Tools Apk
- Pentest Tools Online
- Hacker Tools
- Github Hacking Tools
- Hack Tools Github
- Wifi Hacker Tools For Windows
- Hak5 Tools
- Pentest Tools Apk
- Hacker
- Hack And Tools
- Growth Hacker Tools
- Pentest Tools For Windows
- Hacking App
- Pentest Box Tools Download
- Hacking Tools Pc
- Hacking Tools For Mac
- Pentest Tools Download
- Pentest Tools Port Scanner
- Hacking Tools Pc
- Hacker Security Tools
- Hacking Tools Free Download
- How To Install Pentest Tools In Ubuntu
- Hacks And Tools
- Nsa Hack Tools
- Pentest Tools Framework
- Growth Hacker Tools
- Hack App
- Hacking Tools For Kali Linux
- Hacking Tools Online
- Hacker Tools 2019
- Pentest Tools For Windows
- Hacker Tools 2019
- Pentest Tools Port Scanner
- Hack Tools Download
- Growth Hacker Tools
- New Hack Tools
- Best Pentesting Tools 2018
- Hacking Tools For Beginners
- Hacking Tools Download
- Hack Tools Download
- Pentest Tools Port Scanner
- Ethical Hacker Tools
- Hacking App
- Pentest Box Tools Download
- Hacks And Tools
- Best Pentesting Tools 2018
- New Hacker Tools
- Best Hacking Tools 2019
- Pentest Tools List
- Wifi Hacker Tools For Windows
- Hacking Tools Online
- Hack Tools Online
- Hacking Tools For Pc
- Best Hacking Tools 2020
- Hacker Tool Kit
- Computer Hacker
- Hacker Search Tools
- Hack Tools Mac
- Pentest Tools For Android
- Hacker Tools Github
- Github Hacking Tools
- Pentest Reporting Tools
- Hacking Tools Pc
- Computer Hacker
- Hacking App
- Hack Tools For Pc
- Hackrf Tools
- Hacker Tools Windows
- Pentest Tools List
- Hack Rom Tools
- Hack Website Online Tool
- Bluetooth Hacking Tools Kali
- Hacking Tools For Games
- Hack Tools Online
- Termux Hacking Tools 2019
- Pentest Recon Tools
- Hack Website Online Tool
- Hack Tools Mac
- Hack App
0 条评论:
发表评论
订阅 博文评论 [Atom]
<< 主页