A New Internet Library: Add Your Website/Blog or Suggest A Website/Blog to our Free Web Directory http://anil.myfunda.net.

Its very simple, free and SEO Friendly.
Submit Now....

Thursday, August 27, 2020

Scanning TLS Server Configurations With Burp Suite

In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.

You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases

TLS-Scanner

Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned.  After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration.  Basic tests check the supported cipher suites and protocol versions.  In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.

Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner.  The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).

It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.

Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.

Scan History 

If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.

Additional functions will follow in later versions

Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.

This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget.  The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).

If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
More info
  1. Hacker Tool Kit
  2. Hacker Tools For Mac
  3. Hacker Tools Free Download
  4. Nsa Hack Tools Download
  5. Hak5 Tools
  6. Hacking Tools Hardware
  7. Hacker Tools For Pc
  8. Hack Tools For Games
  9. Pentest Box Tools Download
  10. Nsa Hack Tools
  11. Hacker Tools Linux
  12. Black Hat Hacker Tools
  13. Underground Hacker Sites
  14. Hacking Tools Free Download
  15. Physical Pentest Tools
  16. Free Pentest Tools For Windows
  17. Pentest Automation Tools
  18. Pentest Tools List
  19. Hacking Tools For Mac
  20. Hacker Tools List
  21. Hacker Hardware Tools
  22. Hacker Tools Apk
  23. Hacking Tools Pc
  24. Hacker Tools Free
  25. Top Pentest Tools
  26. Pentest Tools Bluekeep
  27. What Are Hacking Tools
  28. Hack App
  29. Growth Hacker Tools
  30. Pentest Tools Online
  31. Hacking Tools For Windows 7
  32. Hack Tools For Mac
  33. Underground Hacker Sites
  34. Wifi Hacker Tools For Windows
  35. Pentest Tools Website
  36. Hacking Tools For Kali Linux
  37. Hack Tools
  38. Hacking Tools For Pc
  39. Beginner Hacker Tools
  40. Install Pentest Tools Ubuntu
  41. Hack Tool Apk
  42. Hack And Tools
  43. Hacking Tools For Games
  44. Hacker
  45. Hacker Tools Linux
  46. Hacking Tools For Beginners
  47. Bluetooth Hacking Tools Kali
  48. Hacks And Tools
  49. Hack Tools Download
  50. Hack Website Online Tool
  51. Hack Tools Github
  52. Hacking Tools Name
  53. Hacking Tools Github
  54. Pentest Tools Download
  55. Hacking Tools Windows 10
  56. Pentest Tools
  57. Ethical Hacker Tools
  58. What Are Hacking Tools
  59. Beginner Hacker Tools
  60. Pentest Tools For Mac
  61. Android Hack Tools Github
  62. Black Hat Hacker Tools

No comments:

Post a Comment

Post your comments here:

Dotnet-Interviews