Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle empty cookies in JA4H Zeek parsing #158

Merged
merged 5 commits into from
Sep 9, 2024
Merged

Handle empty cookies in JA4H Zeek parsing #158

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
43a4b73
Update release.yml
Squiblydoo Aug 29, 2024
e31f96a
Fix empty cookie hash for Zeek
Squiblydoo Sep 2, 2024
a3ff48e
Merge branch 'FoxIO-LLC:main' into main
Squiblydoo Sep 2, 2024
ad3f536
Revert MacOS build for pushing
Squiblydoo Sep 2, 2024
57b9536
Merge branch 'main' of https://github.com/Squiblydoo/ja4
Squiblydoo Sep 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 37 additions & 27 deletions zeek/ja4h/main.zeek
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,35 +185,45 @@ function get_ja4h_d(c: connection): string {

event http_message_done(c: connection, is_orig: bool, stat: http_message_stat)
{
#print(c$fp$http_client);

if (!is_orig || !c?$fp || !c$fp?$http_client ) { return; }

local ja4h_a = get_ja4h_a(c);
local ja4h_b_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$header_names_o);
local ja4h_b_r = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$header_names);
local ja4h_b = FINGERPRINT::sha256_12(ja4h_b_r);
local ja4h_c_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$cookie_names);
local ja4h_c_r = get_ja4h_c(c);
local ja4h_c = FINGERPRINT::sha256_12(ja4h_c_r);
local ja4h_d_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$cookie_values);
local ja4h_d_r = get_ja4h_d(c);
local ja4h_d = FINGERPRINT::sha256_12(ja4h_d_r);
local delim = FINGERPRINT::delimiter;

c$fp$ja4h$uid = c$uid;

c$fp$ja4h$ja4h = ja4h_a + delim + ja4h_b + delim + ja4h_c + delim + ja4h_d;
c$fp$ja4h$ja4h_r = ja4h_a + delim + ja4h_b_r + delim + ja4h_c_r + delim + ja4h_d_r;
c$fp$ja4h$ja4h_ro = ja4h_a + delim + ja4h_b_o + delim + ja4h_c_o + delim + ja4h_d_o;

c$http$ja4h = c$fp$ja4h$ja4h;
@if(FINGERPRINT::JA4H_raw)
#print(c$fp$http_client);

if (!is_orig || !c?$fp || !c$fp?$http_client ) { return; }

local ja4h_a = get_ja4h_a(c);
local ja4h_b_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$header_names_o);
local ja4h_b_r = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$header_names);
local ja4h_b = FINGERPRINT::sha256_12(ja4h_b_r);
local ja4h_c_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$cookie_names);
local ja4h_c_r = get_ja4h_c(c);
local ja4h_c: string;
if (ja4h_c_r == "") {
ja4h_c = "000000000000";
} else {
ja4h_c = FINGERPRINT::sha256_12(ja4h_c_r);
}
local ja4h_d_o = FINGERPRINT::vector_of_str_to_str(c$fp$http_client$cookie_values);
local ja4h_d_r = get_ja4h_d(c);
local ja4h_d: string;
if (ja4h_d_r == "") {
ja4h_d = "000000000000";
} else {
ja4h_d = FINGERPRINT::sha256_12(ja4h_d_r);
}
local delim = FINGERPRINT::delimiter;

c$fp$ja4h$uid = c$uid;

c$fp$ja4h$ja4h = ja4h_a + delim + ja4h_b + delim + ja4h_c + delim + ja4h_d;
c$fp$ja4h$ja4h_r = ja4h_a + delim + ja4h_b_r + delim + ja4h_c_r + delim + ja4h_d_r;
c$fp$ja4h$ja4h_ro = ja4h_a + delim + ja4h_b_o + delim + ja4h_c_o + delim + ja4h_d_o;

c$http$ja4h = c$fp$ja4h$ja4h;
@if(FINGERPRINT::JA4H_raw)
c$http$ja4h_r = c$fp$ja4h$ja4h_r;
c$http$ja4h_ro = c$fp$ja4h$ja4h_ro;
@endif
@endif


#Log::write(FINGERPRINT::JA4H::LOG, c$fp$ja4h);
#Log::write(FINGERPRINT::JA4H::LOG, c$fp$ja4h);

}