search

LeeBrotherston / tls-fingerprinting

TLS Fingerprinting
GNU General Public License v3.0
379 stars 80 forks source link

how to catch a ja3 fingerprint of burpsuite client ? #49

Open leezp opened 2 years ago

leezp commented 2 years ago

Dear Doctor: I used firefox and set a burpsuite proxy，when I visit a TLS website I set burpsuite Proxy Intercept is on and catch a pcap file. And then I use pyja3 module to get ja3 fingerprint from the pcap file I catched。But I can't find the difference of ja3 fingerprint between I used burpsuite or directly using firefox.

looking forward to your reply.

LeeBrotherston commented 2 years ago

I'm not sure about JA3, as that uses less fields that I do with my technique, so you could legitimately have a fingerprint collision there. If you want to include the PCAPs, more than happy to take a look?