HAProxy - JA3N TLS Client-Fingerprint - Lua Plugin

Test it: fingerprint.oxl.app

Intro

About JA3:

• Salesforce Repository
• HAProxy Enterprise JA3 Fingerprint
• Why JA3 broke => JA3N

NEW: JA4

About JA4:

• JA4+ Suite
• FoxIO Repository
• Cloudflare Blog
• FoxIO Blog
• FoxIO JA4 Database
• JA4 HAProxy Lua Plugin
• JA4H HAProxy Lua Plugin

Browser Fingerprinting:

• Browser Fingerprinting

---

Usage

• Add the LUA script ja3n.lua to your system

Config

• Enable SSL/TLS capture with the global setting tune.ssl.capture-buffer-size 96
• Load the LUA module by adding lua-load /etc/haproxy/lua/ja3n.lua in the global section
• Execute the LUA script on HTTP requests: http-request lua.fingerprint_ja3n
• Log the fingerprint: http-request capture var(txn.fingerprint_ja3n) len 32

---

License

This script is licensed under the MIT-license and thus is free to use.

The JA3 algorithm is licensed under the BSD 3-Clause license and also free to use - see: salesforce/ja3

---

Contribute

If you have:

• Found an issue/bug - please report it
• Have an idea on how to improve it - feel free to start a discussion
• PRs are welcome

Testing

• Run: bash test/run.sh
• Access the test website: https://localhost:6969/
• Or query the API: curl -v https://localhost:6969/api

  {
    "fingerprint": "845df01a87c23862312ff1a2756c3b26",
    "details": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-11-13-16-18-23-27-35-41-43-45-51-17613-65037-65281,4588-29-23-24,0"
  }
  

Exit with CTRL+C