ja3
JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.
Browse cluster: Cluster 181 →Tech stack & purpose
JA3 is a method for creating SSL/TLS client fingerprints that are easy to produce and share for threat intelligence purposes. Invented at Salesforce in 2017, the project analyzes the SSL Client Hello packet to extract and concatenate specific fields (SSL version, ciphers, extensions, elliptic curves, and curve formats), then MD5 hashes the result to create a 32-character fingerprint that remains constant for a given client application regardless of destination or certificate changes. The repository includes implementations in Python and Zeek, along with reference lists mapping JA3 fingerprints to known applications, enabling security professionals to identify both legitimate applications and malware based on how they communicate rather than what they communicate to.
Community & reference links
Languages
Contributors
- jalthouse-sfdc92 commits
- Tommy Stallings12 commits
- Caleb Yu5 commits
- Nate Rosenblum4 commits
- 9b4 commits
- Rakesh Passa3 commits
- Brandon Dixon3 commits
- Ryan Persaud3 commits
- Phil Hagen3 commits
- Sebastian Willenborg2 commits · 32 followers
- tstallings2 commits
- Jason Reaves2 commits
- Sijie Yang1 commits
- weslambert1 commits
- Joshua Atkins1 commits
- Marcus LaFerrera1 commits
- guillermo-menjivar1 commits
- Seth Grover1 commits
- Ryan Guest1 commits
- curob1 commits
- Jon Siwek1 commits
- svc-scm1 commits
- tanjiti1 commits
- dalebowie1 commits
- Salesforce OSPO Service Bot1 commits
- Dale Bowie1 commits
- Didier Stevens1 commits
- Luciano Mammino1 commits
- Jeff Geiger1 commits
