software

This tool computes JA3 and JA3S fingerprints for mobile apps using captured network communication. Originally, the method was developped by John Althouse and others, see https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-24736285 5967. Here, we apply this method on mobile apps and observe reliability and stability of JA3 and JA3S fingerprints. The script creates JA3+JA3S fingerprint databased based on the given dataset with typical mobile app communication. For selection of fingerprints directly related to the app we use Server Name Indication (SNI) string obtained from TLS handshake. Depending on the app, the mobile app fingerprint is composed either by JA3+JA3S hashes only, or as combination of JA3+SNI or JA3+JA3S+SNI.

mobile app fingerprinting, JA3 fingerprinting, digital forensics, network monitoring

10. 7. 2020

Viz https://github.com/matousp/ja3s-fingerprinting.

Využití výsledku jiným subjektem je v některých případech možné bez nabytí licence

Poskytovatel licence na výsledek nepožaduje licenční poplatek

https://www.fit.vut.cz/research/product/646/