JA4 Fingerprint
¿Qué es JA4 Fingerprint?
JA4 FingerprintA 2023 successor to JA3, published by John Althouse at FoxIO, that produces structured, human-readable TLS, HTTP, SSH, and TCP fingerprints designed to remain robust as TLS clients evolve and to be paired across protocols.
JA4 (and the JA4+ family — JA4S, JA4H, JA4X, JA4SSH, JA4T, JA4L) is a 2023 evolution of JA3 published by John Althouse at FoxIO. Where JA3 produced an opaque MD5, JA4 produces a structured string with explicit fields and a small truncated hash, so a fingerprint is both human-readable and trivially groupable by partial match. JA4 covers more parts of the handshake (e.g. signature algorithms, ALPN, the actual TLS version negotiated vs. the offered one) and ignores well-known fields that change for noise reasons, making the resulting fingerprint more stable across TLS-extension shuffling. JA4S fingerprints the server's response, JA4H fingerprints HTTP requests, JA4X fingerprints X.509 certificate issuers, JA4T fingerprints raw TCP options, JA4L estimates light-latency on the path, and JA4SSH fingerprints SSH client handshakes. The license is BSD-3, and integrations exist in Zeek, Wireshark, Suricata, Cloudflare's edge, and several commercial NDR products. JA4-based detections increasingly replace or complement JA3 in modern threat-hunt content.
● Ejemplos
- 01
An NDR product tags a high-confidence Cobalt Strike beacon by matching its JA4 fingerprint plus a JA4H HTTP header pattern.
- 02
A defender writes a Suricata rule that alerts on any TLS client whose JA4 matches a known Go-`net/http` malware family but whose JA4H differs from the legitimate Go SDK signature.
● Preguntas frecuentes
¿Qué es JA4 Fingerprint?
A 2023 successor to JA3, published by John Althouse at FoxIO, that produces structured, human-readable TLS, HTTP, SSH, and TCP fingerprints designed to remain robust as TLS clients evolve and to be paired across protocols. Pertenece a la categoría de Seguridad de red en ciberseguridad.
¿Qué significa JA4 Fingerprint?
A 2023 successor to JA3, published by John Althouse at FoxIO, that produces structured, human-readable TLS, HTTP, SSH, and TCP fingerprints designed to remain robust as TLS clients evolve and to be paired across protocols.
¿Cómo funciona JA4 Fingerprint?
JA4 (and the JA4+ family — JA4S, JA4H, JA4X, JA4SSH, JA4T, JA4L) is a 2023 evolution of JA3 published by John Althouse at FoxIO. Where JA3 produced an opaque MD5, JA4 produces a structured string with explicit fields and a small truncated hash, so a fingerprint is both human-readable and trivially groupable by partial match. JA4 covers more parts of the handshake (e.g. signature algorithms, ALPN, the actual TLS version negotiated vs. the offered one) and ignores well-known fields that change for noise reasons, making the resulting fingerprint more stable across TLS-extension shuffling. JA4S fingerprints the server's response, JA4H fingerprints HTTP requests, JA4X fingerprints X.509 certificate issuers, JA4T fingerprints raw TCP options, JA4L estimates light-latency on the path, and JA4SSH fingerprints SSH client handshakes. The license is BSD-3, and integrations exist in Zeek, Wireshark, Suricata, Cloudflare's edge, and several commercial NDR products. JA4-based detections increasingly replace or complement JA3 in modern threat-hunt content.
¿Cómo defenderse de JA4 Fingerprint?
Las defensas contra JA4 Fingerprint combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para JA4 Fingerprint?
Nombres alternativos comunes: JA4+, JA4S, JA4H, JA4X.
● Términos relacionados
- network-security№ 628
JA3 Fingerprint
A TLS client fingerprinting method by John Althouse, Jeff Atkinson, and Josh Atkins (Salesforce, 2017) that hashes the ordered TLS ClientHello parameters into a 32-character MD5 — used to identify and group TLS clients without inspecting payload.
- network-security№ 1280
Handshake TLS
Intercambio inicial del protocolo Transport Layer Security que autentica al servidor (y opcionalmente al cliente) y deriva las claves simétricas que cifran el resto de la sesión.
- network-security№ 1279
TLS (Transport Layer Security)
Protocolo criptográfico estandarizado por el IETF que aporta confidencialidad, integridad y autenticación al tráfico entre dos aplicaciones en red.
- defense-ops№ 338
Ingenieria de deteccion
Disciplina de disenar, probar, desplegar y mantener detecciones de seguridad como codigo, con cobertura medible sobre tecnicas adversarias.
- network-security№ 326
Inspección profunda de paquetes (DPI)
Técnica de inspección que examina toda la carga útil de los paquetes —no solo las cabeceras— para identificar aplicaciones, contenido y amenazas.
- network-security№ 609
Sistema de detección de intrusiones (IDS)
Control de seguridad pasivo que supervisa la actividad de red o de host en busca de comportamiento malicioso y genera alertas sin bloquear el tráfico.