diff --git a/python/ja4h.py b/python/ja4h.py index 5c13fb7..962f712 100644 --- a/python/ja4h.py +++ b/python/ja4h.py @@ -24,14 +24,14 @@ def to_ja4h(x, debug_stream=-1): unsorted_cookie_values = [] x['headers'] = [ h.split(':')[0] for h in x['headers'] ] - x['headers'] = [ h for h in x['headers'] - if not h.startswith(':') and not h.lower().startswith('cookie') + x['headers'] = [ h for h in x['headers'] + if not h.startswith(':') and not h.lower().startswith('cookie') and h.lower() != 'referer' and h ] raw_headers = x['headers'][:] #x['headers'] = [ '-'.join([ y.capitalize() for y in h.split('-')]) for h in x['headers'] ] - header_len = '{:02d}'.format(len(x['headers'])) + header_len = '{:02d}'.format(min(len(x['headers']), 99)) if 'cookies' in x: if isinstance(x['cookies'], list): diff --git a/technical_details/JA4H.md b/technical_details/JA4H.md new file mode 100644 index 0000000..f6c10af --- /dev/null +++ b/technical_details/JA4H.md @@ -0,0 +1,9 @@ +# JA4H: HTTP Client Fingerprint + +![JA4H](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4H.png) + +JA4H fingerprints the HTTP client based on each HTTP request. + +### Number of Headers: +2 digit number of headers, not counting Cookie and Referer. For 3 headers the value is "03". +If there are more than 99, the output is 99.