ja4 v1.0.0
JA4+ is a suite of network fingerprinting standards
JA4+™ Network Fingerprinting
JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for threat actors, malware detection, session hijacking prevention, compliance automation, location tracking, DDoS detection, grouping of threat actors, reverse shell detection, and many more.
For a quick explainer on JA4+ and to use as a reference during analysis see:
JA4+ Cheat Sheet
For in-depth detail, please read our blogs on how JA4+ works, why it works, and examples of what can be detected/prevented with it:
JA4+ Network Fingerprinting (JA4/S/H/L/X/SSH)
JA4T: TCP Fingerprinting (JA4T/TS/TScan)
Investigating Surfshark and NordVPN with JA4T (JA4T)
JA4D and JA4D6: DHCP Fingerprinting (JA4D/6)
If you love JA4+, consider getting a t-shirt or hoodie:
JA4+ Shirts, Hoodies, and Stickers
Table of contents
- Current methods and implementation details
- Implementations
- Tools that support JA4+
- Examples
- Plugins
- Binaries
- Database
- Release Process
- JA4+ Details
- Licensing
- Q&A
- JA4+ was created by
Current methods and implementation details
| Full Name | Short Name | Description |
|---|---|---|
| JA4 | JA4 | TLS Client Fingerprinting |
| JA4Server | JA4S | TLS Server Response / Session Fingerprinting |
| JA4HTTP | JA4H | HTTP Client Fingerprinting |
| JA4Latency | JA4L | Client to Server Latency Measurment / Light Distance |
| JA4LatencyServer | JA4LS | Server to Client Latency Measurement / Light Distance |
| JA4X509 | JA4X | X509 TLS Certificate Fingerprinting |
| JA4SSH | JA4SSH | SSH Traffic Fingerprinting |
| JA4TCP | JA4T | TCP Client Fingerprinting |
| JA4TCPServer | JA4TS | TCP Server Response Fingerprinting |
| JA4TCPScan | JA4TScan | Active TCP Fingerprint Scanner |
| JA4DHCP | JA4D | DHCP Fingerprinting |
| JA4DHCPv6 | JA4D6 | DHCPv6 Fingerprinting |
| JA4NTP | JA4N | NTP Fingerprinting |
| JA4Scan-TLS | JA4Scan-TLS | Active TLS Server Fingerprint Scanner |
| JA4Scan-QUIC | JA4Scan-QUIC | Active QUIC Server Fingerprint Scanner |
The full name or short name can be used interchangeably. Additional JA4+ methods are in the works...
To understand how to read JA4+ fingerprints, see Technical Details
Implementations
This repo includes JA4+ in