lexiforest / curl_cffi

Python binding for curl-impersonate fork via cffi. A http client that can impersonate browser tls/ja3/http2 fingerprints.
https://curl-cffi.readthedocs.io/
MIT License
2.49k stars 265 forks source link

Safari fingerprint for MacOS v18_0 not matching the fingerprint for v17_0 impersonate #439

Open charliedelta02 opened 2 days ago

charliedelta02 commented 2 days ago

The question The safari browser v17_0 impersonate fingerprint observed on https://tls.browserleaks.com/json is:

{
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15",
  "ja3_hash": "773906b0efdefa24a7f2b8eb6985bf37",
  "ja3_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0",
  "ja3n_hash": "44f7ed5185d22c92b96da72dbe68d307",
  "ja3n_text": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-5-10-11-13-16-18-21-23-27-43-45-51-65281,29-23-24-25,0",
  "ja4": "t13d2014h2_a09f3c656075_14788d8d241b",
  "ja4_r": "t13d2014h2_000a,002f,0035,009c,009d,1301,1302,1303,c008,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0015,0017,001b,002b,002d,0033,ff01_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201",
  "ja4_o": "t13d2014h2_de3eb69493ac_65135c5c1a6b",
  "ja4_ro": "t13d2014h2_1301,1302,1303,c02c,c02b,cca9,c030,c02f,cca8,c00a,c009,c014,c013,009d,009c,0035,002f,c008,c012,000a_0000,0017,ff01,000a,000b,0010,0005,000d,0012,0033,002d,002b,001b,0015_0403,0804,0401,0503,0203,0805,0805,0501,0806,0601,0201",
  "akamai_hash": "959a7e813b79b909a1a0b00a38e8bba3",
  "akamai_text": "2:0;4:4194304;3:100|10485760|0|m,s,p,a"
}

Whereas, the safari v18_0 fingerprint on a MAC laptop observed on https://tls.browserleaks.com/json is:

{
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15",
  "ja3_hash": "78d450322efcbf3f5d2d92f9d7769566",
  "ja3_text": "771,49199-49171-49191-49200-49172-49192-156-47-60-157-53-61-65-132-49195-49324-49326-49161-49187-49196-49325-49327-49162-49188-158-51-103-159-57-107-69-136-4865-4866-255,0-10-11-13-23-43-51,23-29-24-256-257-258,0",
  "ja3n_hash": "78d450322efcbf3f5d2d92f9d7769566",
  "ja3n_text": "771,49199-49171-49191-49200-49172-49192-156-47-60-157-53-61-65-132-49195-49324-49326-49161-49187-49196-49325-49327-49162-49188-158-51-103-159-57-107-69-136-4865-4866-255,0-10-11-13-23-43-51,23-29-24-256-257-258,0",
  "ja4": "t13d350700_98f6b5ae8975_e74d7d97755c",
  "ja4_r": "t13d350700_002f,0033,0035,0039,003c,003d,0041,0045,0067,006b,0084,0088,009c,009d,009e,009f,00ff,1301,1302,c009,c00a,c013,c014,c023,c024,c027,c028,c02b,c02c,c02f,c030,c0ac,c0ad,c0ae,c0af_000a,000b,000d,0017,002b,0033_0401,0804,0403,0501,0805,0503,0601,0806,0603",
  "ja4_o": "t13d350700_f6fb28e5a594_070f1dc89d25",
  "ja4_ro": "t13d350700_c02f,c013,c027,c030,c014,c028,009c,002f,003c,009d,0035,003d,0041,0084,c02b,c0ac,c0ae,c009,c023,c02c,c0ad,c0af,c00a,c024,009e,0033,0067,009f,0039,006b,0045,0088,1301,1302,00ff_0000,000a,000b,000d,0017,002b,0033_0401,0804,0403,0501,0805,0503,0601,0806,0603",
  "akamai_hash": "",
  "akamai_text": ""
}

Neither the ja3n nor the ja3 fingerprints match. So, it would not be possible to use safari17_0 impersonate with safari version 18_0 and above on a mac.

As for iOS, I see that safari is on v17_6_1 and it still matches the fingerprint of safari17_2_ios. Fingerprint might change for v18_0 for iOS. Will keep you posted.

Is a new impersonate in the works for safari? How should we handle this?

lexiforest commented 1 day ago

Could please elaborate on your platform details, my Safari does not share the same fingerprints with yours.

charliedelta02 commented 1 day ago

Could please elaborate on your platform details, my Safari does not share the same fingerprints with yours.

Curl-Cffi: v0.7.3

MacOS:

Chip: Apple M1 Pro
macOS: macOS Sonoma (v14.7.1)

Safari on Mac: Version 18.1 (19619.2.8.111.5, 19619)

The latest curl-cffi library version available is 0.7.3, but in the documentation, I do see support for safari18_0 and safati18_0_ios. But, this is on v0.8.0. Is this even available for use?