Bypass JA3
JA3 fingerprints are now used by web servers to identify clients based on thier TLS ClientHello packets. when servers identify clients as malicious tools such as Brup, Nessus, Nexpose, … they get blocked.
How JA3 fingerprinting works ?
if you don’t know about JA3 please refer to this artcile to understant the concept and how it works then comeback :).
Check you JA3 fingerprint
curl -X GET ‘https://ja3er.com/json'
Python
Tried to change user-agent but it’s useless.
curl -X GET ‘https://ja3er.com/search/eaa1a9e1db47ffcca16305566a6efba4'
How to bypass JA3 fingerprinting based detection
Well, it’s actually pretty simple to bypass this detection mecanisme, we can spoof the JA3 of Chrome and send our request and we won’t be blocked.
Get Youssef ENNACIRI’s stories in your inbox
Join Medium for free to get updates from this writer.
Let’s see this scenario in action :
This Graph basically show how we are going to bypass JA3 fingerprints
First part is using a non-browser application to access the web server which uses JA3 fingerprints detection, and i’m going to use a python script
Seconds part is to use ja3-proxy to intercept TLS ClientHello packets and tamper them to spoof JA3 fingerprints
Now we send the request to ja3er.com in order to see if our JA3 fingerprint has changed
Apparently this proxy is not working but still we can bypass JA3
we start by importing ja3transport packages and run a GO script to connect to ja3er.com and retrieve JA3 fingerprint and indeed we recieved JA3 fingerprints of Mozilla/5.0
go get github.com/CUCyber/ja3transport
go run JA3TransportClient.go
