tlsx icon indicating copy to clipboard operation
tlsx copied to clipboard

JA3S fingerprint support

Open ehsandeep opened this issue 3 years ago • 1 comments

Adding support for JA3S based TLS fingerprinting.

Reference:

  • https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/

CLI Flag:

   -ja3s                display ja3 fingerprint hash

JSON Flag:

  "ja3s_hash": "XXXXX"

ehsandeep avatar Jun 30 '22 04:06 ehsandeep

putting on hold for now:

  • calculating ja3s fingerprint hash is not possible with ztls cause it doesn't log all the server hello extensions: https://github.com/zmap/zcrypto/blob/master/tls/tls_handshake.go#L56, https://github.com/zmap/zcrypto/blob/master/tls/tls_handshake.go#L337
  • packet capture implementation requires libpcap-dev https://github.com/projectdiscovery/tlsx/tree/ja3

parrasajad avatar Jul 20 '22 14:07 parrasajad