wader/fq
1
1
Fork 0
mirror of https://github.com/wader/fq.git synced 2024-12-21 04:11:55 +03:00
Code Issues Projects Releases Wiki Activity
03316988aa
fq/format/tls/testdata/ja3.fqtest

12 lines
447 B
Plaintext
Raw Normal View History

tls: Add TLS 1.0, 1.1, 1.2 decode and decryption What it can do: - Decodes records and most standard messages and extensions. - Decryptes records and reassemples application data stream if a keylog is provided and the cipher suite is supported. - Supports most recommended and used ciphers and a bunch of older ones. What it can't do: - SSL v3 maybe supported, is similar to TLS 1.0, not tested. - Decryption and renegotiation/cipher change. - Record defragmentation not supported, seems rare over TCP. - TLS 1.3 - SSL v2 but v2 compat header is supported. - Some key exchange messages not decoded yet Decryption code is heavly based on golang crypto/tls and zmap/zcrypto. Will be base for decoding http2 and other TLS based on protocols. Fixes #587
2023-02-10 22:06:38 +03:00
$ fq -L . 'include "ja3"; pcap_ja3' testtls.com.http1.1-tls1.2.pcap
[
{
"client_ip": "192.168.1.230",
"client_port": 61925,
"ja3": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-13,29-23-30-25-24,0-1-2",
"ja3_digest": "87b9bfc7da97115ed2276737b09f8d74",
"server_ip": "116.203.76.237",
"server_port": 443
}
]
Reference in New Issue Copy Permalink