Share
Embed
Slide 1
Slide 1 text
HTTPSFingerprint
@junk_coken
Slide 2
Slide 2 text
• 3(@junk_coken)
• HTTP
&*/%
'
($- '
)+",# !.
Slide 3
Slide 3 text
HTTPS
HTTPS
()
Slide 4
Slide 4 text
HTTPS
1.
• DDNSOK
2. let’s encrypt
3. Nginx
Slide 5
Slide 5 text
HTTPHTTPS
0
200
400
600
800
1000
1200
HTTP HTTPS
2019129201922
1134 60
HTTPS 468
Slide 6
Slide 6 text
Fingerprint
Slide 7
Slide 7 text
Fingerprinting
(
)
Machine Fingerprint
Fingerprinting
Slide 8
Slide 8 text
Fingerprinting
Passive fingerprinting
•
( )
Slide 9
Slide 9 text
Fingerprinting
Active fingerprinting
•
(JavaScript )
Slide 10
Slide 10 text
HoneypotFingerprint
• p0f
• OS "
• T-POT #
• FingerprintJS
• %
• Micro Honeypot ($
'&
• TLS Fingerprint
• JA3, HASSH
→OSS
SSH Cowrie !(HASSH)
Slide 11
Slide 11 text
fingerprintjs2 - https://valve.github.io/fingerprintjs2/
Slide 12
Slide 12 text
HoneypotFingerprint
• p0f
• OS "
• T-POT #
• FingerprintJS
• %
• Micro Honeypot ($
'&
• TLS Fingerprint
• JA3, HASSH
→OSS
SSH Cowrie !(HASSH)
Slide 13
Slide 13 text
JA3
JA3(https://github.com/salesforce/ja3)
• $ &%,'*,", !+
• Black Hat Arsenal 2016
TLS Fingerprinting1
• HTTPS>8-45 3
E2.
$ # /@=? D;
),#
>8 %#
6C:
(-A7”(+
B9>8
0<” )
Slide 14
Slide 14 text
JA3
1. Client Hello
2. Server Hello,
Server Certificate,
Server Key Exchange,
Server Hello Done
3. Client Key Exchange,
Change Cipher Spec,
Finished
4. Change Cipher Spec,
Finished
HTTPS
JA3
Slide 15
Slide 15 text
JA3
Client Hello
• SSL Version
• Cipher Suite
• Extension
• Elliptic Curves
• Elliptic Curve Point Formats
10 MD5
Slide 16
Slide 16 text
16
← 771
← 49162
← 49195
← 49169
← 49159
← 49171
← 49161
← 49172
← 49199
← 5
← 47
← 53
← 49170
← 10
← 0
← 5
← 10
← 23
← 24
← 25
← 11
← 13
← 65281
771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-
11-13-65281,23-24-25,0
↓MD5
20c9baf81bfe96ff89722899e75d0190
Slide 17
Slide 17 text
Web (Nginx)
tcpdump(
)
(pcap)
HTTPS
ELK
Slide 18
Slide 18 text
Fingerprint
ja3fingerprint.json
(https://github.com/trisulnsm/trisul-
scripts/tree/master/lua/frontend_scripts/reassembly/ja3/prints)
• JA3 fingerprint
•
Slide 19
Slide 19 text
Fingerprint
fingerprint
Slide 20
Slide 20 text
• HTTPS # &
→%
!
•
"( '$
Slide 21
Slide 21 text
ma couleur