|
| 1 | +/** |
| 2 | + * @author n1474335 [n1474335@gmail.com] |
| 3 | + * @copyright Crown Copyright 2021 |
| 4 | + * @license Apache-2.0 |
| 5 | + * |
| 6 | + * JA3S created by Salesforce |
| 7 | + * John B. Althouse |
| 8 | + * Jeff Atkinson |
| 9 | + * Josh Atkins |
| 10 | + * |
| 11 | + * Algorithm released under the BSD-3-clause licence |
| 12 | + */ |
| 13 | + |
| 14 | +import Operation from "../Operation.mjs"; |
| 15 | +import OperationError from "../errors/OperationError.mjs"; |
| 16 | +import Utils from "../Utils.mjs"; |
| 17 | +import Stream from "../lib/Stream.mjs"; |
| 18 | +import {runHash} from "../lib/Hash.mjs"; |
| 19 | + |
| 20 | +/** |
| 21 | + * JA3S Fingerprint operation |
| 22 | + */ |
| 23 | +class JA3SFingerprint extends Operation { |
| 24 | + |
| 25 | + /** |
| 26 | + * JA3SFingerprint constructor |
| 27 | + */ |
| 28 | + constructor() { |
| 29 | + super(); |
| 30 | + |
| 31 | + this.name = "JA3S Fingerprint"; |
| 32 | + this.module = "Crypto"; |
| 33 | + this.description = "Generates a JA3S fingerprint to help identify TLS servers based on hashing together values from the Server Hello.<br><br>Input: A hex stream of the TLS Server Hello record in the application layer."; |
| 34 | + this.infoURL = "https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967"; |
| 35 | + this.inputType = "string"; |
| 36 | + this.outputType = "string"; |
| 37 | + this.args = [ |
| 38 | + { |
| 39 | + name: "Input format", |
| 40 | + type: "option", |
| 41 | + value: ["Hex", "Base64", "Raw"] |
| 42 | + }, |
| 43 | + { |
| 44 | + name: "Output format", |
| 45 | + type: "option", |
| 46 | + value: ["Hash digest", "JA3S string", "Full details"] |
| 47 | + } |
| 48 | + ]; |
| 49 | + } |
| 50 | + |
| 51 | + /** |
| 52 | + * @param {string} input |
| 53 | + * @param {Object[]} args |
| 54 | + * @returns {string} |
| 55 | + */ |
| 56 | + run(input, args) { |
| 57 | + const [inputFormat, outputFormat] = args; |
| 58 | + |
| 59 | + input = Utils.convertToByteArray(input, inputFormat); |
| 60 | + const s = new Stream(new Uint8Array(input)); |
| 61 | + |
| 62 | + const handshake = s.readInt(1); |
| 63 | + if (handshake !== 0x16) |
| 64 | + throw new OperationError("Not handshake data."); |
| 65 | + |
| 66 | + // Version |
| 67 | + s.moveForwardsBy(2); |
| 68 | + |
| 69 | + // Length |
| 70 | + const length = s.readInt(2); |
| 71 | + if (s.length !== length + 5) |
| 72 | + throw new OperationError("Incorrect handshake length."); |
| 73 | + |
| 74 | + // Handshake type |
| 75 | + const handshakeType = s.readInt(1); |
| 76 | + if (handshakeType !== 2) |
| 77 | + throw new OperationError("Not a Server Hello."); |
| 78 | + |
| 79 | + // Handshake length |
| 80 | + const handshakeLength = s.readInt(3); |
| 81 | + if (s.length !== handshakeLength + 9) |
| 82 | + throw new OperationError("Not enough data in Server Hello."); |
| 83 | + |
| 84 | + // Hello version |
| 85 | + const helloVersion = s.readInt(2); |
| 86 | + |
| 87 | + // Random |
| 88 | + s.moveForwardsBy(32); |
| 89 | + |
| 90 | + // Session ID |
| 91 | + const sessionIDLength = s.readInt(1); |
| 92 | + s.moveForwardsBy(sessionIDLength); |
| 93 | + |
| 94 | + // Cipher suite |
| 95 | + const cipherSuite = s.readInt(2); |
| 96 | + |
| 97 | + // Compression Method |
| 98 | + s.moveForwardsBy(1); |
| 99 | + |
| 100 | + // Extensions |
| 101 | + const extensionsLength = s.readInt(2); |
| 102 | + const extensions = s.getBytes(extensionsLength); |
| 103 | + const es = new Stream(extensions); |
| 104 | + const exts = []; |
| 105 | + while (es.hasMore()) { |
| 106 | + const type = es.readInt(2); |
| 107 | + const length = es.readInt(2); |
| 108 | + es.moveForwardsBy(length); |
| 109 | + exts.push(type); |
| 110 | + } |
| 111 | + |
| 112 | + // Output |
| 113 | + const ja3s = [ |
| 114 | + helloVersion.toString(), |
| 115 | + cipherSuite, |
| 116 | + exts.join("-") |
| 117 | + ]; |
| 118 | + const ja3sStr = ja3s.join(","); |
| 119 | + const ja3sHash = runHash("md5", Utils.strToArrayBuffer(ja3sStr)); |
| 120 | + |
| 121 | + switch (outputFormat) { |
| 122 | + case "JA3S string": |
| 123 | + return ja3sStr; |
| 124 | + case "Full details": |
| 125 | + return `Hash digest: |
| 126 | +${ja3sHash} |
| 127 | +
|
| 128 | +Full JA3S string: |
| 129 | +${ja3sStr} |
| 130 | +
|
| 131 | +TLS Version: |
| 132 | +${helloVersion.toString()} |
| 133 | +Cipher Suite: |
| 134 | +${cipherSuite} |
| 135 | +Extensions: |
| 136 | +${exts.join("-")}`; |
| 137 | + case "Hash digest": |
| 138 | + default: |
| 139 | + return ja3sHash; |
| 140 | + } |
| 141 | + } |
| 142 | + |
| 143 | +} |
| 144 | + |
| 145 | +export default JA3SFingerprint; |
0 commit comments