Beta Branch prep for SSL/TLS JA3 fingerprint Nginx module support in 123.09beta01

eva2000 · Dec 15, 2021

prep for SSL/TLS JA3 fingerprint Nginx module support in 123.09beta01

- add optional support for SSL/TLS JA3 fingerprint Nginx module support GitHub - centminmod/nginx-ssl-fingerprint: high performance SSL/TLS ja3 fingerprint for nginx. and GitHub - salesforce/ja3: JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
- disabled by default for now for proper testing. Can be enabled setting NGINX_TLS_FINGERPRINT='y' in persistent config file /etc/centminmod/custom_config.inc prior to Nginx compile/recompile via centmin.sh menu option 4

Continue reading...

123.09beta01 branch

Branch: GitHub - centminmod/centminmod at 123.09beta01

Commit History: Commits · centminmod/centminmod

eva2000 · Dec 15, 2021

As per GitHub - salesforce/ja3: JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way. for SSL/TLS fingerprint profiling of visitors

JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.

Before using, please read this blog post: TLS Fingerprinting with JA3 and JA3S
Click to expand...
How it works
TLS and it’s predecessor, SSL, I will refer to both as “SSL” for simplicity, are used to encrypt communication for both common applications, to keep your data secure, and malware, so it can hide in the noise. To initiate a SSL session, a client will send a SSL Client Hello packet following the TCP 3-way handshake. This packet and the way in which it is generated is dependant on packages and methods used when building the client application. The server, if accepting SSL connections, will respond with a SSL Server Hello packet that is formulated based on server-side libraries and configurations as well as details in the Client Hello. Because SSL negotiations are transmitted in the clear, it’s possible to fingerprint and identify client applications using the details in the SSL Client Hello packet.

JA3 is a method of TLS fingerprinting that was inspired by the research and works of Lee Brotherston and his TLS Fingerprinting tool: FingerprinTLS.

JA3 gathers the decimal values of the bytes for the following fields in the Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a "," to delimit each field and a "-" to delimit each value in each field.

The field order is as follows:
Code (Text):
SSLVersion,Cipher,SSLExtension,EllipticCurve,EllipticCurvePointFormat
Example:
Code (Text):
769,47-53-5-10-49161-49162-49171-49172-50-56-19-4,0-10-11,23-24-25,0
Click to expand...
Centmin Mod Nginx with optional Nginx fingerprint module installed
Code (Text):
  add_header X-FP "$http_ssl_ja3";
  add_header X-FP-Hash "$http_ssl_ja3_hash";
Code (Text):
curl -4Ik https://log4j.domain.com
HTTP/1.1 200 OK
Date: Tue, 14 Dec 2021 15:05:49 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 6592
Last-Modified: Mon, 13 Dec 2021 04:21:48 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "61b6ca5c-19c0"
Server: nginx centminmod
X-Powered-By: centminmod
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-FP: 771,49196-49162-49195-52393-49161-49200-49172-49199-52392-49171-159-57-56-107-158-52394-51-50-103-22-19-157-53-61-156-47-60-10,0-23-65281-10-11-13-28,29-23-24-25,0
X-FP-Hash: c8446f59cca2149cb5f56ced4b448c8d
Accept-Ranges: bytes
nginx -V
nginx version: nginx/1.21.4 (141221-145729-centos7-kvm-1dc3704)
built by gcc 10.2.1 20210130 (Red Hat 10.2.1-11) (GCC)
built with OpenSSL 1.1.1l 24 Aug 2021
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/zlib-cf/lib:/usr/local/lib -fuse-ld=gold' --with-cc-opt='-I/usr/local/zlib-cf/include -I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wno-error=pointer-sign -Wimplicit-fallthrough=0 -Wno-implicit-function-declaration -Wno-int-conversion -Wno-error=unused-result -Wno-unused-result -fcode-hoisting -Wno-cast-function-type -Wno-format-extra-args -Wp,-D_FORTIFY_SOURCE=2' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=141221-145729-centos7-kvm-1dc3704 --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --add-dynamic-module=../njs/nginx --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.5.1 --add-dynamic-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.62 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.19 --add-module=../srcache-nginx-module-0.32 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.1l --add-module=../nginx-ssl-fingerprint --with-openssl-opt='enable-ec_nistp_64_gcc_128 enable-tls1_3 -fuse-ld=gold' --add-dynamic-module=../ModSecurity-nginx
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

Beta Branch prep for SSL/TLS JA3 fingerprint Nginx module support in 123.09beta01

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

Beta Branch prep for SSL/TLS JA3 fingerprint Nginx module support in 123.09beta01

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.