openbullet / openbullet/OpenBullet2

[Bug]: Custom Cipher Suites doesn't seem to work

Open
#744 7 comments 0 reactions 1 assignee View on GitHub

@openbullet is already working on this.

Since Jun 7, 2024.

bug
Dominant language
C#
Stars
2.4k
Forks
603
PR merge metrics
No merged PRs in 30d

Description

Version of the software

0.2.4

Operating system

Windows Server 2019

Browser / Native

Chrome

What happened?

According to https://github.com/salesforce/ja3

JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence.

JA3 gathers the decimal values of the bytes for the following fields in the Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. It then concatenates those values together in order, using a "," to delimit each field and a "-" to delimit each value in each field.

You can view your tls fingerprint here: https://ja3er.com/ or here in JSON format: https://ja3er.com/json

I made a small project to get JA3 fingerprint of Openbullet2(code provided below).

After sending multiple requests, JA3 fingerprint hash was identical for all of them. Next, I changed Http Library to SystemNet and switched on Use Custom Cipher Suites, according to how JA3 fingerprinting works, the hash should change as one of five values is Accepted Ciphers, leaving only of the default listed chipers in OpenBullet2, the hash stayed identical to what I got previously.
Proof: https://prnt.sc/D4LP4AEw4bsO and https://prnt.sc/gekBrmu8Mz13
So, my conclusion is: Custom Cipher Suites does not work as it should, giving various custom chipers should change TLS fingerprint to bypass WAF of such companies as Akamai, etc.

Article to better understand how spoofing JA3 works: https://medium.com/cu-cyber/impersonating-ja3-fingerprints-b9f555880e42

Relevant LoliCode if needed
BLOCK:HttpRequest
LABEL:ja3
  url = "https://ja3er.com/json"
  httpLibrary = SystemNet
  useCustomCipherSuites = True
  TYPE:STANDARD
  ""
  "application/x-www-form-urlencoded"
ENDBLOCK

BLOCK:Parse
LABEL:hash
  input = @data.SOURCE
  jToken = "ja3_hash"
  MODE:Json
  => VAR @hash
ENDBLOCK

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.