From 79d8b61d2f66d08d94de9fd0d3eaa4083e2aef5c Mon Sep 17 00:00:00 2001 From: John Althouse <84981330+john-althouse@users.noreply.github.com> Date: Tue, 3 Oct 2023 17:26:05 -0400 Subject: [PATCH] Update README.md --- technical_details/README.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/technical_details/README.md b/technical_details/README.md index 444ba11..0306e50 100644 --- a/technical_details/README.md +++ b/technical_details/README.md @@ -1,7 +1,10 @@ # JA4+ Technical Details -[JA4](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md) - TLS Client Fingerprinting -[JA4S](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4S.md) - TLS Server/Session Fingerprinting -[JA4H](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4H.md) - HTTP Client Fingerprinting -[JA4L](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4L.md) - Light Distance Locality -[JA4X](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4X.md) - X509 TLS Certificate Fingerprinting -[JA4SSH](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4SSH.md) - SSH Traffic Fingerprinting +[JA4: TLS Client Fingerprinting](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md) +[JA4S: TLS Server/Session Fingerprinting](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4S.md) +[JA4H: HTTP Client Fingerprinting](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4H.md) +[JA4L: Light Distance Locality](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4L.md) +[JA4X: X509 TLS Certificate Fingerprinting](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4X.md) +[JA4SSH: SSH Traffic Fingerprinting](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4SSH.md) + +### JA4+ General Rules +1. If a hashed field is empty, the output is 000s instead of a hash of an empty field. This is more conducive for analysis.