相伴江湖 -- Be With You

2024年1月20日星期六

Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.

More information


  1. Termux Hacking Tools 2019
  2. Pentest Tools Port Scanner
  3. Hacking Tools For Mac
  4. New Hack Tools
  5. Hacking Tools
  6. Pentest Tools Framework
  7. Hack Tools Online
  8. Pentest Tools Download
  9. Hacking Tools
  10. Pentest Tools Kali Linux
  11. World No 1 Hacker Software
  12. Hacker Tools Apk
  13. Hacking Tools Free Download
  14. Pentest Tools Tcp Port Scanner
  15. Hack Tools For Pc
  16. Hacker Tools Mac
  17. Install Pentest Tools Ubuntu
  18. Hacker Tools Apk Download
  19. Hack Tools For Windows
  20. Hacker Tools For Ios
  21. Hackers Toolbox
  22. Hacker Tools For Ios
  23. Pentest Recon Tools
  24. Pentest Tools Alternative
  25. Growth Hacker Tools
  26. Pentest Tools For Android
  27. Pentest Tools Apk
  28. Tools 4 Hack
  29. Hacking Tools For Beginners
  30. Hacking Tools 2020
  31. Hacking Tools 2019
  32. Hacker Search Tools
  33. Hacking Tools For Mac
  34. Hacker Tools For Windows
  35. How To Install Pentest Tools In Ubuntu
  36. Hacker Tools Mac
  37. Tools For Hacker
  38. Pentest Tools Url Fuzzer
  39. Easy Hack Tools
  40. Hack Apps
  41. Easy Hack Tools
  42. Hacker Tools 2020
  43. Hacking App
  44. Hacking Tools Mac
  45. Ethical Hacker Tools
  46. Pentest Tools Website
  47. Hacking Tools For Beginners
  48. Hack Tools
  49. Hacker Security Tools
  50. Pentest Tools Find Subdomains
  51. Hack Apps
  52. Hacking Tools 2020
  53. Hackers Toolbox
  54. Hacker Tools Apk
  55. Pentest Tools Online
  56. Hacker Tools
  57. Github Hacking Tools
  58. Hack Tools Github
  59. Wifi Hacker Tools For Windows
  60. Hak5 Tools
  61. Pentest Tools Apk
  62. Hacker
  63. Hack And Tools
  64. Growth Hacker Tools
  65. Pentest Tools For Windows
  66. Hacking App
  67. Pentest Box Tools Download
  68. Hacking Tools Pc
  69. Hacking Tools For Mac
  70. Pentest Tools Download
  71. Pentest Tools Port Scanner
  72. Hacking Tools Pc
  73. Hacker Security Tools
  74. Hacking Tools Free Download
  75. How To Install Pentest Tools In Ubuntu
  76. Hacks And Tools
  77. Nsa Hack Tools
  78. Pentest Tools Framework
  79. Growth Hacker Tools
  80. Hack App
  81. Hacking Tools For Kali Linux
  82. Hacking Tools Online
  83. Hacker Tools 2019
  84. Pentest Tools For Windows
  85. Hacker Tools 2019
  86. Pentest Tools Port Scanner
  87. Hack Tools Download
  88. Growth Hacker Tools
  89. New Hack Tools
  90. Best Pentesting Tools 2018
  91. Hacking Tools For Beginners
  92. Hacking Tools Download
  93. Hack Tools Download
  94. Pentest Tools Port Scanner
  95. Ethical Hacker Tools
  96. Hacking App
  97. Pentest Box Tools Download
  98. Hacks And Tools
  99. Best Pentesting Tools 2018
  100. New Hacker Tools
  101. Best Hacking Tools 2019
  102. Pentest Tools List
  103. Wifi Hacker Tools For Windows
  104. Hacking Tools Online
  105. Hack Tools Online
  106. Hacking Tools For Pc
  107. Best Hacking Tools 2020
  108. Hacker Tool Kit
  109. Computer Hacker
  110. Hacker Search Tools
  111. Hack Tools Mac
  112. Pentest Tools For Android
  113. Hacker Tools Github
  114. Github Hacking Tools
  115. Pentest Reporting Tools
  116. Hacking Tools Pc
  117. Computer Hacker
  118. Hacking App
  119. Hack Tools For Pc
  120. Hackrf Tools
  121. Hacker Tools Windows
  122. Pentest Tools List
  123. Hack Rom Tools
  124. Hack Website Online Tool
  125. Bluetooth Hacking Tools Kali
  126. Hacking Tools For Games
  127. Hack Tools Online
  128. Termux Hacking Tools 2019
  129. Pentest Recon Tools
  130. Hack Website Online Tool
  131. Hack Tools Mac
  132. Hack App

0 条评论:

发表评论

订阅 博文评论 [Atom]



<< 主页