Package org.microproxy.extras

Class TlsFingerprints

java.lang.Object
org.microproxy.extras.TlsFingerprints
public final class TlsFingerprints extends Object
TLS client fingerprints of a ClientHello, as access logs show them ( %TLS_JA3_FINGERPRINT%, %TLS_JA4_FINGERPRINT%): JA3, the MD5 of the hello's version, cipher suites, extensions, groups and point formats, and JA4, a readable prefix and two truncated SHA-256 hashes of the sorted cipher suites and extensions. GREASE values (RFC 8701) are left out of both, as the algorithms say.

  • Method Summary

    Modifier and Type
    Method
    Description
    static String
    ja3(ClientHello hello)
    The JA3 fingerprint: the lowercase hex MD5 of ja3String(org.microproxy.ClientHello).
    static String
    ja3String(ClientHello hello)
    The JA3 string: version,ciphers,extensions,groups,point_formats, each list's values in decimal, in the hello's order, separated by -.
    static String
    ja4(ClientHello hello)
    The JA4 fingerprint of a hello sent over TCP.
    static String
    ja4(ClientHello hello, boolean quic)
    The JA4 fingerprint: a_b_c, where a is the transport (t for TCP, q for QUIC), the highest TLS version offered (13, 12, ...), d with SNI or i without, the counts of cipher suites and extensions (two digits each), and the first and last characters of the first ALPN protocol (00 without); b is the first 12 hex digits of the SHA-256 of the sorted cipher suites (4-digit hex, comma separated); c the same of the sorted extensions without SNI and ALPN, followed by _ and the signature algorithms in their order when there are any.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • ja3String

      public static String ja3String(ClientHello hello)
      The JA3 string: version,ciphers,extensions,groups,point_formats, each list's values in decimal, in the hello's order, separated by -.
      Parameters:
      hello - the ClientHello
      Returns:
      the JA3 string, or null when the hello cannot be read

    • ja3

      public static String ja3(ClientHello hello)
      The JA3 fingerprint: the lowercase hex MD5 of ja3String(org.microproxy.ClientHello).
      Parameters:
      hello - the ClientHello
      Returns:
      the fingerprint, or null when the hello cannot be read

    • ja4

      public static String ja4(ClientHello hello)
      The JA4 fingerprint of a hello sent over TCP.
      Parameters:
      hello - the ClientHello
      Returns:
      the fingerprint, or null when the hello cannot be read

    • ja4

      public static String ja4(ClientHello hello, boolean quic)
      The JA4 fingerprint: a_b_c, where a is the transport (t for TCP, q for QUIC), the highest TLS version offered (13, 12, ...), d with SNI or i without, the counts of cipher suites and extensions (two digits each), and the first and last characters of the first ALPN protocol (00 without); b is the first 12 hex digits of the SHA-256 of the sorted cipher suites (4-digit hex, comma separated); c the same of the sorted extensions without SNI and ALPN, followed by _ and the signature algorithms in their order when there are any.
      Parameters:
      hello - the ClientHello
      quic - whether the hello came in QUIC Initial packets
      Returns:
      the fingerprint, or null when the hello cannot be read