search

bcgit / bc-csharp

BouncyCastle.NET Cryptography Library (Mirror)
https://www.bouncycastle.org/csharp
MIT License
1.65k stars 552 forks source link

How can i change ja3 extension? #478

Closed sictem2018 closed 7 months ago

sictem2018 commented 1 year ago

my ja3 fingerprint key is: 771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,23-22-21-17513-4-13-43-28-51-65281-11-10-45-5-1-0-41,29-23-24,0 So, i want to change the Client Extension to this 771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0 Thanks for help!

cipherboy commented 7 months ago

@sictem2018 According to here: https://github.com/salesforce/ja3?tab=readme-ov-file#how-it-works

You're asking to change the SSL Extensions of a TLS handshake, from the current value to a given value. Using a registry, it looks like we have in the original:

23-22-21-17513-4-13-43-28-51-65281-11-10-45-5-1-0-41

23 indicates extended master secret, I believe.

You want 0, which is server name.

(Note, I've not decoded those values fully -- perhaps you're asking for something different, and if so, perhaps clarifying would be good :-)

I believe this could be as simple as making sure the server names are set on connection. To do this, you'd override AbstractTlsClient.GetSniServerNames(...) in your TlsClient implementation. You may also have to restrict yourself strictly to TLSv1.2 mode to avoid getting the Extended Master Secret extension added automatically, based on comments in the code.