In this post, we present our new Burp Suite extension "TLS-Attacker".
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.
You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases
Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner. The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).
It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.
Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.
This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget. The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).
If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
Using this extension penetration testers and security researchers can assess the security of TLS server configurations directly from within Burp Suite.
The extension is based on the TLS-Attacker framework and the TLS-Scanner, both of which are developed by the Chair for Network and Data Security.
You can find the latest release of our extension at: https://github.com/RUB-NDS/TLS-Attacker-BurpExtension/releases
TLS-Scanner
Thanks to the seamless integration of the TLS-Scanner into the BurpSuite, the penetration tester only needs to configure a single parameter: the host to be scanned. After clicking the Scan button, the extension runs the default checks and responds with a report that allows penetration testers to quickly determine potential issues in the server's TLS configuration. Basic tests check the supported cipher suites and protocol versions. In addition, several known attacks on TLS are automatically evaluated, including Bleichenbacher's attack, Padding Oracles, and Invalid Curve attacks.
Furthermore, the extension allows fine-tuning for the configuration of the underlying TLS-Scanner. The two parameters parallelProbes and overallThreads can be used to improve the scan performance (at the cost of increased network load and resource usage).
It is also possible to configure the granularity of the scan using Scan Detail and Danger Level. The level of detail contained in the returned scan report can also be controlled using the Report Detail setting.
Please refer to the GitHub repositories linked above for further details on configuration and usage of TLS-Scanner.
Scan History
If several hosts are scanned, the Scan History tab keeps track of the preformed scans and is a useful tool when comparing the results of subsequent scans.
Additional functions will follow in later versions
Currently, we are working on integrating an at-a-glance rating mechanism to allow for easily estimating the security of a scanned host's TLS configuration.This is a combined work of Nurullah Erinola, Nils Engelbertz, David Herring, Juraj Somorovsky, Vladislav Mladenov, and Robert Merget. The research was supported by the European Commission through the FutureTrust project (grant 700542-Future-Trust-H2020-DS-2015-1).
If you would like to learn more about TLS, Juraj and Robert will give a TLS Training at Ruhrsec on the 27th of May 2019. There are still a few seats left.
More articles
- Hacking Tools For Beginners
- Hack Tools Pc
- Hack Rom Tools
- How To Hack
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Open Source
- Ethical Hacker Tools
- Pentest Tools For Mac
- Hacker Tools Apk Download
- Best Hacking Tools 2019
- Hack Tools 2019
- Hack Tools 2019
- Underground Hacker Sites
- Pentest Tools Windows
- Underground Hacker Sites
- Hacking Tools Github
- Hacking Tools For Pc
- Pentest Tools Kali Linux
- Hacking Apps
- Free Pentest Tools For Windows
- Kik Hack Tools
- Pentest Tools Online
- How To Hack
- Hacker Tools Apk Download
- Nsa Hack Tools
- Pentest Tools Open Source
- Tools 4 Hack
- Hacking Tools 2019
- Pentest Tools Website Vulnerability
- How To Install Pentest Tools In Ubuntu
- Pentest Tools For Ubuntu
- Top Pentest Tools
- Hacking Tools Kit
- Pentest Tools Android
- Hacker Tools 2020
- Pentest Reporting Tools
- What Are Hacking Tools
- Pentest Automation Tools
- Ethical Hacker Tools
- Hacking Apps
- Hacking Tools For Windows Free Download
- Computer Hacker
- Hacking Tools For Windows 7
- Hacking Tools And Software
- Physical Pentest Tools
- Hacker Tools Software
- Hacking Tools Download
- Hacking Tools
- Pentest Reporting Tools
- Hacker Tools
- World No 1 Hacker Software
- Hack Tools For Ubuntu
- Nsa Hack Tools Download
- Hacker Tools Free
- Hacker Tools Software
- Hacking Tools Pc
- Hacking Tools Online
- Hacker Search Tools
- Hacking Tools
- Hacking Tools Windows
- Hacking Tools And Software
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Github
- Pentest Tools Find Subdomains
- Hacker Tools Apk Download
- Pentest Tools For Windows
- Hack Website Online Tool
- Hacker Tools Linux
- Physical Pentest Tools
- Hacking Tools Github
- Pentest Tools For Windows
- Hacker Tools For Ios
- Growth Hacker Tools
- New Hacker Tools
- Top Pentest Tools
- Hack Tools Online
- Pentest Tools Windows
- Termux Hacking Tools 2019
- Hack Website Online Tool
- Best Hacking Tools 2019
- Pentest Recon Tools
- Pentest Automation Tools
- Best Pentesting Tools 2018
- Pentest Tools Windows
- Hacker Tools For Pc
Nenhum comentário:
Postar um comentário