GRUPO 40121

Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
More articles
  1. Wifi Hacker Tools For Windows
  2. Hack Website Online Tool
  3. Hacker Tools For Windows
  4. New Hacker Tools
  5. Hacker Tools Free Download
  6. Pentest Automation Tools
  7. Hacking Tools Name
  8. Hacking Tools For Pc
  9. Hacking Tools 2019
  10. Hack Tools Online
  11. Hack Tools For Ubuntu
  12. Pentest Reporting Tools
  13. Hacker Tools Online
  14. Hack Tools 2019
  15. Pentest Tools For Mac
  16. Pentest Tools Open Source
  17. Hacking Tools For Windows
  18. Pentest Tools Review
  19. Hacking Tools Hardware
  20. Hak5 Tools
  21. Hacking Tools
  22. Hacking Tools Software
  23. Pentest Tools Linux
  24. Hacking Tools Pc
  25. Hacking Tools Online
  26. Hack Tool Apk No Root
  27. Best Hacking Tools 2019
  28. Pentest Tools Port Scanner
  29. Blackhat Hacker Tools
  30. Hacking Tools Kit
  31. Best Hacking Tools 2019
  32. Hacker Tools 2020
  33. Pentest Tools Open Source
  34. Hackers Toolbox
  35. Hack Tools Pc
  36. Hack Tools For Pc
  37. How To Hack
  38. Hacking Tools Windows
  39. Hacker Tools Github
  40. Best Hacking Tools 2019
  41. Beginner Hacker Tools
  42. Pentest Tools Online
  43. Hacker Tools Github
  44. Easy Hack Tools
  45. Hacking Tools Name
  46. Hacking Tools For Games
  47. Tools For Hacker
  48. Hacker Tools Online
  49. Hacking Tools Online
  50. Pentest Tools Find Subdomains
  51. Hacking Tools For Windows 7
  52. Hack Tool Apk
  53. Easy Hack Tools
  54. Hacker Tools For Pc
  55. Black Hat Hacker Tools
  56. Pentest Tools Alternative
  57. Hacker Tools 2020
  58. Wifi Hacker Tools For Windows
  59. Hacker Tools Apk Download
  60. Pentest Tools Framework
  61. Blackhat Hacker Tools
  62. Easy Hack Tools
  63. Hack Tools For Mac
  64. Hackrf Tools
  65. Blackhat Hacker Tools
  66. Pentest Tools Port Scanner
  67. Pentest Tools For Ubuntu
  68. Hak5 Tools
  69. Pentest Tools For Windows
  70. Hacking Tools Usb
  71. Hacker Tools Windows
  72. Hacker Hardware Tools
  73. Hacking Tools Usb
  74. Pentest Reporting Tools
  75. Hacker Tools
  76. Hacking Tools For Pc
  77. Hacking Tools For Beginners
  78. Tools 4 Hack
  79. Hacking Tools For Kali Linux
  80. Tools Used For Hacking
  81. Pentest Tools Android
  82. Pentest Tools Android
  83. Hacker Tools 2020
  84. Hacker Tools Linux
  85. Hacking App
  86. Hacking Tools Mac
  87. Hack Tool Apk No Root
  88. Pentest Tools Nmap
  89. Pentest Box Tools Download
  90. Wifi Hacker Tools For Windows
  91. Hacking Tools For Games
  92. Pentest Tools Review
  93. Pentest Tools Alternative
  94. Free Pentest Tools For Windows
  95. Hacking Tools Hardware
  96. Install Pentest Tools Ubuntu
  97. Pentest Tools Apk
  98. Physical Pentest Tools
  99. Free Pentest Tools For Windows
  100. Hack Rom Tools
  101. World No 1 Hacker Software
  102. Pentest Tools Github
  103. Best Hacking Tools 2019
  104. Pentest Tools Online
  105. Hack Tools For Games
  106. Hack Tools For Mac
  107. Pentest Tools Linux
  108. Hacking Tools Download
  109. Pentest Tools Android
  110. Pentest Tools Review
  111. Hack Tools Mac
  112. Pentest Tools
  113. Hacking Tools Pc
  114. Pentest Tools Port Scanner
  115. Black Hat Hacker Tools
  116. Computer Hacker
  117. Hacking Tools For Mac
  118. Hacking Tools Kit
  119. Pentest Tools Nmap
  120. Ethical Hacker Tools
  121. Hack Tools For Ubuntu
  122. Underground Hacker Sites
  123. Easy Hack Tools
  124. Hacker Tools Hardware
  125. Hack Tools
  126. Hacker Tools Mac
  127. Beginner Hacker Tools
  128. Hackrf Tools
  129. Hacking Tools 2020
  130. Pentest Tools For Windows
  131. What Are Hacking Tools
  132. Hacking Tools Free Download
  133. What Are Hacking Tools
  134. Top Pentest Tools
  135. Usb Pentest Tools
  136. Hacking Tools Usb
  137. Hacking Tools 2019
  138. New Hacker Tools
  139. Hacking Tools And Software
  140. Easy Hack Tools
  141. Pentest Tools Free
  142. Hack Tools Github
  143. Hack Tool Apk No Root
  144. Pentest Tools Find Subdomains
  145. Hacking Tools Free Download
  146. Pentest Tools Nmap
  147. Pentest Tools Url Fuzzer
  148. Pentest Tools Linux
  149. Tools For Hacker
  150. Pentest Tools Website Vulnerability
  151. Nsa Hack Tools Download

No hay comentarios:

Publicar un comentario

Nota: solo los miembros de este blog pueden publicar comentarios.