|
1 | | -# sensor-d4-tls-fingerprinting |
2 | | -Extracts TLS certificates from pcap files or network interfaces (tcpreassembly is done thanks to gopacket), fingerprints TLS client/server interactions with ja3/ja3s and print output in JSON form. |
| 1 | +<p align="center"> |
| 2 | + <img alt="sensor-d4-tls-fingerprinting" src="https://raw.githubusercontent.com/D4-project/sensor-d4-tls-fingerprinting/master/media/gopherd4.png" height="140" /> |
| 3 | + <p align="center"> |
| 4 | + <a href="https://github.com/D4-project/sensor-d4-tls-fingerprinting/releases/latest"><img alt="Release" src="https://img.shields.io/github/release/D4-project/sensor-d4-tls-fingerprinting/all.svg"></a> |
| 5 | + <a href="https://github.com/D4-project/sensor-d4-tls-fingerprinting/blob/master/LICENSE"><img alt="Software License" src="https://img.shields.io/badge/License-MIT-yellow.svg"></a> |
| 6 | + <a href="https://goreportcard.com/report/github.com/D4-Project/sensor-d4-tls-fingerprinting"><img alt="Go Report Card" src="https://goreportcard.com/badge/github.com/D4-Project/sensor-d4-tls-fingerprinting"></a> |
| 7 | + </p> |
| 8 | +</p> |
| 9 | + |
| 10 | +**sensor-d4-tls-fingerprinting** is intended to be used to feed a D4 project client (It can be used in standalone though). |
| 11 | + |
| 12 | +# Main features |
| 13 | + |
| 14 | + * extracts TLS certificates from pcap files or network interfaces |
| 15 | + * fingerprints TLS client/server interactions with ja3/ja3s |
| 16 | + * fingerprints TLS interactions with TLSH fuzzy hashing |
| 17 | + * write certificates in a folder |
| 18 | + * export in JSON to files, or stdout |
| 19 | + |
3 | 20 | # Use |
4 | | -This project is currently in its very early stage and should not be used in production. |
5 | | - Check the list of issues. |
6 | | -## Install dependencies & go get |
| 21 | +This project is currently in development and is subject to change, check the list of issues. |
| 22 | + |
| 23 | +## Compile from source |
| 24 | +### requirements |
| 25 | + * git |
| 26 | + * golang >= 1.5 |
| 27 | + * libpcap |
| 28 | + |
| 29 | +``` shell |
| 30 | +#apt install golang git libpcap-dev |
| 31 | +``` |
| 32 | +### Go get |
| 33 | + |
7 | 34 | ``` shell |
8 | | -$go get github.com/google/gopacket |
9 | | -$go get github.com/glaslos/tlsh |
10 | 35 | $go get github.com/D4-project/sensor-d4-tls-fingerprinting |
| 36 | +$cd $GOPATH/github.com/D4-project/sensor-d4-tls-fingerprinting |
| 37 | +$ |
11 | 38 | ``` |
12 | | -make allows to compile for amd64 and arm ATM. |
| 39 | +A "sensor-d4-tls-fingerprinting" compiled for your architecture should then be in $GOPATH/bin |
| 40 | +Alternatively, use make to compile arm/linux or amd64/linux |
| 41 | + |
13 | 42 | ## How to use |
14 | 43 |
|
15 | 44 | Read from pcap: |
|
0 commit comments