ja3

Documentation

Index

• Variables
• func Bare(hello *tlsx.ClientHelloBasic) []byte
• func BareToDigestHex(bare []byte) string
• func Digest(hello *tlsx.ClientHelloBasic) [md5.Size]byte
• func DigestHex(hello *tlsx.ClientHelloBasic) string

Variables

var (
	// Debug indicates whether we run in debug mode.
	Debug = false
)

Functions

func Bare

func Bare(hello *tlsx.ClientHelloBasic) []byte

Bare returns the JA3 bare string for a given tlsx.ClientHelloBasic instance JA3 is a technique developed by Salesforce, to fingerprint TLS Client Hellos. the official python implementation can be found here: https://github.com/salesforce/ja3 JA3 gathers the decimal values of the bytes for the following fields; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a “,” to delimit each field and a “-” to delimit each value in each field. The field order is as follows: SSLVersion,Ciphers,Extensions,EllipticCurves,EllipticCurvePointFormats Example: 769,47–53–5–10–49161–49162–49171–49172–50–56–19–4,0–10–11,23–24–25,0 If there are no SSL Extensions in the Client Hello, the fields are left empty. Example: 769,4–5–10–9–100–98–3–6–19–18–99,,, These strings are then MD5 hashed to produce an easily consumable and shareable 32 character fingerprint. This is the JA3 SSL Client Fingerprint returned by this function.

func BareToDigestHex

func BareToDigestHex(bare []byte) string

BareToDigestHex converts a bare []byte to a hex string.

func Digest

func Digest(hello *tlsx.ClientHelloBasic) [md5.Size]byte

Digest returns only the digest md5.

func DigestHex

func DigestHex(hello *tlsx.ClientHelloBasic) string

DigestHex produce md5 hash from bare string.