search

FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
774 stars 65 forks source link

Zeek JA4H hashes an empty string instead of outputting 0000s #123

Open john-althouse opened 4 weeks ago

john-althouse commented 4 weeks ago

Bug in JA4H on Zeek, when there's no cookie, it's supposed to output 0000's, like po10nn060000_cdb958d032b0_000000000000_000000000000 But instead it's hashing an empty string so it does: po10nn060000_cdb958d032b0_e3b0c44298fc_e3b0c44298fc