Widget by:Get Widget
Beranda » Tanpa Kategori » Scanning TLS Server Configurations With Burp Suite

Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
Related articles

  1. Hacking Tools Online
  2. Hacking Tools
  3. Wifi Hacker Tools For Windows
  4. Hacker
  5. Hacker Tools Mac
  6. Pentest Tools For Android
  7. Hacking Tools Hardware
  8. Hack Tools Github
  9. Hacks And Tools
  10. Tools 4 Hack
  11. Hack Tools Download
  12. Hack App
  13. Top Pentest Tools
  14. Pentest Tools Website
  15. Pentest Tools Website Vulnerability
  16. Pentest Tools Framework
  17. Pentest Tools Linux
  18. Hacking Tools 2019
  19. Hacking Tools For Beginners
  20. Pentest Tools For Windows
  21. Hacker Security Tools
  22. Game Hacking
  23. Hackers Toolbox
  24. Hack Tools Mac
  25. Pentest Reporting Tools
  26. Android Hack Tools Github
  27. Pentest Tools For Windows
  28. Hacking Tools For Windows Free Download
  29. Pentest Tools Alternative
  30. Hacking Tools For Pc
  31. Hacking Tools Download
  32. Pentest Tools Open Source
  33. Hacker Tools 2020
  34. Tools Used For Hacking
  35. Hacking Tools For Windows Free Download
  36. Hacking Tools For Kali Linux
  37. Blackhat Hacker Tools
  38. Hack Tools Online
  39. Pentest Tools Framework
  40. Pentest Tools Download
  41. Pentest Tools Free
  42. Hacking Tools Windows
  43. Pentest Tools Url Fuzzer
  44. Hacking Tools And Software
  45. Termux Hacking Tools 2019
  46. Pentest Tools Review
  47. Easy Hack Tools
  48. Hack Tool Apk No Root
  49. Top Pentest Tools
  50. Hacker Hardware Tools
  51. Blackhat Hacker Tools
  52. Pentest Tools Download
  53. Termux Hacking Tools 2019
  54. Pentest Tools Kali Linux
  55. Hacker Tools List
  56. Pentest Tools For Ubuntu
  57. Hack Tools For Pc
  58. Github Hacking Tools
  59. New Hacker Tools
  60. Pentest Tools Windows
  61. Hacking Tools Free Download
  62. Pentest Tools Android
  63. Pentest Tools Linux

Postingan terkait:

— — Add Comment Edit Post

Belum ada tanggapan untuk "Scanning TLS Server Configurations With Burp Suite"

Posting Komentar

Langganan: Posting Komentar (Atom)