1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

import hashlib
from typing import List, Tuple

class JA4Fingerprint:
    """JA4 指纹生成器"""

    def __init__(self):
        self.grease_values = {
            0x0a0a, 0x1a1a, 0x2a2a, 0x3a3a, 0x4a4a,
            0x5a5a, 0x6a6a, 0x7a7a, 0x8a8a, 0x9a9a,
            0xaaaa, 0xbaba, 0xcaca, 0xdada, 0xeaea, 0xfafa
        }

    def generate(self, client_hello: dict) -> str:
        """
        生成 JA4 指纹

        Args:
            client_hello: 解析后的 Client Hello 数据
                - protocol: 'tls' 或 'quic'
                - version: TLS 版本 (如 0x0303 表示 TLS 1.2)
                - ciphers: 加密套件列表
                - extensions: 扩展列表
                - signature_algorithms: 签名算法列表

        Returns:
            JA4 指纹字符串
        """
        # 1. 协议标识
        protocol = 't' if client_hello.get('protocol') == 'tls' else 'q'

        # 2. TLS 版本
        version = self._get_version_string(client_hello.get('version', 0x0303))

        # 3. 过滤 GREASE 值
        ciphers = [c for c in client_hello.get('ciphers', [])
                   if c not in self.grease_values]
        extensions = [e for e in client_hello.get('extensions', [])
                      if e not in self.grease_values]

        # 4. 排序标识
        sorted_ciphers = sorted(ciphers)
        is_sorted = 'd' if ciphers == sorted_ciphers else 'i'

        # 5. 计数
        cipher_count = f"{len(ciphers):02d}"
        ext_count = f"{len(extensions):02d}"

        # 6. GREASE 计数
        grease_count = sum(1 for c in client_hello.get('ciphers', [])
                          if c in self.grease_values)
        grease_str = f"h{grease_count}" if grease_count > 0 else ""

        # 7. 扩展哈希 (取前12位)
        ext_hash = self._hash_list(sorted(extensions))[:12]

        # 8. 签名算法哈希
        sig_algs = client_hello.get('signature_algorithms', [])
        sig_hash = self._hash_list(sig_algs)[:12]

        # 组装指纹
        prefix = f"{protocol}{version}{is_sorted}{cipher_count}{ext_count}{grease_str}"
        return f"{prefix}_{ext_hash}_{sig_hash}"

    def _get_version_string(self, version: int) -> str:
        """将 TLS 版本转换为字符串"""
        version_map = {
            0x0301: "10",  # TLS 1.0
            0x0302: "11",  # TLS 1.1
            0x0303: "12",  # TLS 1.2
            0x0304: "13",  # TLS 1.3
        }
        return version_map.get(version, "00")

    def _hash_list(self, items: List[int]) -> str:
        """对列表进行哈希"""
        data = ','.join(f"{x:04x}" for x in items)
        return hashlib.sha256(data.encode()).hexdigest()


class JA4HFingerprint:
    """JA4H (HTTP) 指纹生成器"""

    def generate(self, http_request: dict) -> str:
        """
        生成 JA4H 指纹

        Args:
            http_request: HTTP 请求数据
                - method: 请求方法 (GET, POST, etc.)
                - version: HTTP 版本 (1.1, 2, 3)
                - headers: Header 字典 (保持顺序)

        Returns:
            JA4H 指纹字符串
        """
        # 协议
        version = http_request.get('version', '1.1')
        if version == '2':
            proto = 'h2'
        elif version == '3':
            proto = 'h3'
        else:
            proto = 'h1'

        # 方法
        method = http_request.get('method', 'GET')[0].lower()

        # Header 名称列表 (小写，保持顺序)
        headers = http_request.get('headers', {})
        header_names = [k.lower() for k in headers.keys()]

        # Header 哈希
        header_hash = hashlib.sha256(','.join(header_names).encode()).hexdigest()[:12]

        # Cookie 存在标识
        has_cookie = 'c' if 'cookie' in header_names else 'n'

        # Referer 存在标识
        has_referer = 'r' if 'referer' in header_names else 'n'

        return f"{proto}{method}{has_cookie}{has_referer}_{header_hash}"


# 使用示例
if __name__ == "__main__":
    # 模拟 Chrome 的 Client Hello
    chrome_hello = {
        'protocol': 'tls',
        'version': 0x0304,  # TLS 1.3
        'ciphers': [
            0x1301, 0x1302, 0x1303,  # TLS 1.3 ciphers
            0xc02c, 0xc02b, 0xc030,  # ECDHE ciphers
        ],
        'extensions': [
            0x0000,  # server_name
            0x0017,  # extended_master_secret
            0x0023,  # session_ticket
            0x000d,  # signature_algorithms
            0x002b,  # supported_versions
            0x002d,  # psk_key_exchange_modes
            0x0033,  # key_share
        ],
        'signature_algorithms': [0x0403, 0x0503, 0x0603, 0x0804, 0x0805],
    }

    ja4 = JA4Fingerprint()
    fingerprint = ja4.generate(chrome_hello)
    print(f"JA4 Fingerprint: {fingerprint}")

    # 模拟 HTTP 请求
    http_req = {
        'method': 'GET',
        'version': '2',
        'headers': {
            'Host': 'example.com',
            'User-Agent': 'Mozilla/5.0...',
            'Accept': '*/*',
            'Accept-Language': 'en-US',
            'Cookie': 'session=abc123',
        }
    }

    ja4h = JA4HFingerprint()
    http_fp = ja4h.generate(http_req)
    print(f"JA4H Fingerprint: {http_fp}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# Wireshark / tshark 提取 JA4
# 需要安装 JA4+ 插件: https://github.com/FoxIO-LLC/ja4

# 使用 tshark 提取 JA4 指纹
tshark_cmd = """
tshark -r capture.pcap -Y "tls.handshake.type == 1" \
    -T fields -e ip.src -e ja4.ja4
"""

# Zeek (Bro) 集成
zeek_script = """
@load ja4

event ssl_client_hello(c: connection, version: count, ...) {
    local ja4 = JA4::fingerprint(c);
    print fmt("JA4: %s from %s", ja4, c$id$orig_h);
}
"""