dreadl0ck / ja3

Go package for Ja3 TLS client and server hello fingerprints
BSD 3-Clause "New" or "Revised" License
144 stars 21 forks source link

Invalid Ja3 when GREASE value is at the end of extensions #16

Closed myles-keough closed 1 year ago

myles-keough commented 1 year ago

https://github.com/dreadl0ck/ja3/blob/0c3c870539be01047bbf3d8d94e611e7efb56d17/ja3.go#L121-L139

I'm seeing a small discrepancy between this library and pyja3. When the final extension is a GREASE value, a trailing '-' is left on. It appears this can happen with ciphers as well, but I haven't seen that actually manifest.

Example:

771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-51-43-16-10-65281-17513-13-27-5-11-35-45-0,29-23-24,0 (pyja3)
771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-51-43-16-10-65281-17513-13-27-5-11-35-45-0-,29-23-24,0 (this library)

Here's a sample hex client hello to reproduce:

1603010201010001fd030316aa71dc4b3931d23f02de5b79220115f7c0148b91b0b2f2ad580dae1437c927206f244e8429100fdfb4501431c6c354d80e2b284251995d8f4f8bfe7ac7402ccd00205a5a130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035010001944a4a000000170000001200000033002b0029fafa000100001d00201929be474921dfe2125cdeca802e4e0610e76ff2ca4ab27e57d7a182a58fd205002b0007060a0a030403030010000e000c02683208687474702f312e31000a000a0008fafa001d00170018ff01000100446900050003026832000d0012001004030804040105030805050108060601001b0003020002000500050100000000000b00020100002300d082491ebd07c9757ca3daa0d7612b23d3edf38e075325a044ac4ac89eae5ab05b1ead8f97b87d3fde5774bb373d2d7a92c615ebbd3ec50b71dcfc465459295843dceae0ea377e592f355f22d5f32f27ff051daf8be16e8c2768bf1f8dba24f44258b9fc3f5872d4e7fd791171361b05f3ed2aca177c3a6e69ae7452af76d9176fd8538a8c364af5b37d0f6de6af0f065632e603d9b9c04d5fc49701bf5bf6bafce840bd0de75acc00a8a2d06b764a08a485f9ebb642d69c834f6e4319fc7cf584e59c9b04942b8d1c78feb876717e43b3002d0002010100000011000f00000c69622e61646e78732e636f6dfafa000100
dreadl0ck commented 1 year ago

Nice catch, thanks for contributing!