search

wi1dcard / fingerproxy

Fingerproxy is an HTTPS reverse proxy. It creates JA3, JA4, Akamai HTTP2 fingerprints, and forwards to backend via HTTP request headers.
Apache License 2.0
54 stars 9 forks source link
fingerprinting http2-fingerprint ja3 ja4 reverse-proxy tls

readme

Fingerproxy

Inspired by gospider007/fp. Fingerproxy is an HTTPS reverse proxy. It creates JA3, JA4, Akamai HTTP2 fingerprints, and forwards to backend via HTTP request headers.

         TLS                            HTTP/1.1 or HTTP/2
Client ------>   Fingerproxy    ------------------------------------>  HTTP Backend
                (listens :443)    | With request headers:        |    (127.0.0.1:80)
                                  | X-JA3-Fingerprint: abcd...   |
                                  | X-JA4-Fingerprint: t13d...   |
                                  | X-HTTP2-Fingerprint: 3:100...|

Fingerprints can be used for bot detection, DDoS mitigation, client identification, etc. To use these fingerprints, just extract the HTTP request headers in your backend apps.

Fingerproxy is also a Go library, which allows users implementing their own fingerprinting algorithm.

Usage

[!TIP] Try fingerproxy in 1 minute:

  1. Generate a self-signed certificate tls.crt and tls.key for testing.

    openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -days 3650 \
  -nodes -keyout tls.key -out tls.crt -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1"

  2. Download the fingerproxy binary and run. The TLS server listens on :8443, forwarding requests to httpbin.

    ./fingerproxy -listen-addr :8443 -forward-url https://httpbin.org

  3. We are ready to go. Send a request to fingerproxy:

    curl "https://localhost:8443/anything?show_env=1" --insecure

    You will see that fingerprints are in HTTP request headers:

    {
  "headers": {
    # ...
    "X-Forwarded-Host": "localhost:8443",
    "X-Forwarded-Port": "443",
    "X-Forwarded-Proto": "https",
    "X-Http2-Fingerprint": "3:100;4:10485760;2:0|1048510465|0|m,s,a,p",
    "X-Ja3-Fingerprint": "0149f47eabf9a20d0893e2a44e5a6323",
    "X-Ja4-Fingerprint": "t13d3112h2_e8f1e7e78f70_6bebaf5329ac"
  },
  # ...
}

For all available CLI options, see fingerproxy --help.

Production-Ready

The fingerproxy binary is production-ready. Subscan.io has 12 fingerproxy instances running in the production environment, which process almost 40,000,000 requests/day on average.

Unit tests, memory usage tests, E2E tests, and benchmarks have been implemented and run on GitHub Actions.

And of course, fingerproxy follows SemVer.

Kubernetes and Prometheus Integration

Kubernetes liveness probe support is available since v0.3.0. Example:

apiVersion: v1
kind: Pod
metadata:
  name: fingerproxy
spec:
  containers:
  - name: fingerproxy
    image: fingerproxy
    livenessProbe:
      httpGet:
        path: /
        port: 443
        scheme: https

Kubernetes probes use certain User-Agent such as kube-probe/1.26. Therefore, those requests with the specific user-agent header can be recognized as probing requests. Instead of forwarding to the backend app, fingerproxy will simply respond with an HTTP 200 by itself.

The default Prometheus metrics server listens on :9035. Once new requests come in, run curl http://localhost:9035/ to see avaialble metrics.

Implement Your Fingerprinting Algorithm

Check out the examples ja3-raw or my-fingerprint. No code fork needed.

Chrome JA3 Fingerprints Change Every Time

Yes, it is an known issue of the original JA3 implementation. See Google Chrome TLS extension permutation. Sorting the TLS extension is one method to avoid the affect of this feature. Here is an example ja3-sorted-extensions.

Use as a Library

Fingerproxy is degigned to be highly customizable. It is separated into serveral packages. You can find all packages in the pkg dir and use them to build your own fingerprinting server.

Here is an example echo-server. Instead of forwarding HTTP requests, it simply responds back to client with the fingerprints.

Similar Projects

Useful Websites

References