fingerproxy

package module
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 17, 2024 License: Apache-2.0 Imports: 17 Imported by: 0

README

Fingerproxy

Inspired by gospider007/fp. Fingerproxy is an HTTPS reverse proxy, despite, it calculates JA3, JA4, and Akamai HTTP2 fingerprints and adds them to forwarding request headers.

Usage

[!TIP] Download Fingerproxy binary from latest GitHub Release. Try it in one minute:

# Generate fake certificates tls.crt and tls.key
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -days 3650 \
  -nodes -keyout tls.key -out tls.crt -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1"

# TLS server listens on :8443, forwarding requests to httpbin
./fingerproxy -listen-addr :8443 -forward-url https://httpbin.org

# Then test in another terminal
curl "https://localhost:8443/anything?show_env=1" --insecure

Fingerprint headers are added to the requests:

{
  "headers": {
    # ...
    "X-Forwarded-Host": "localhost:8443",
    "X-Forwarded-Port": "443",
    "X-Forwarded-Proto": "https",
    "X-Http2-Fingerprint": "3:100;4:10485760;2:0|1048510465|0|m,s,a,p",
    "X-Ja3-Fingerprint": "0149f47eabf9a20d0893e2a44e5a6323",
    "X-Ja4-Fingerprint": "t13d3112h2_e8f1e7e78f70_6bebaf5329ac"
  },
  # ...
}

In most Fingerproxy use cases, the traffic route would be:

         TLS                            HTTP/1.1 or HTTP/2
Client ------>   Fingerproxy    ------------------------------------>  HTTP Backend
                (listens :443)    | With request headers:        |   (127.0.0.1:8000)
                                  | X-JA3-Fingerprint: abcd...   |
                                  | X-JA4-Fingerprint: t13d...   |
                                  | X-HTTP2-Fingerprint: 3:100...|

For the complete CLI options, see fingerproxy --help.

Implement Your Fingerprinting Algorithm

Take a look at example/customize-fingerprint/, if you want to implement your own fingerprint algorithm with Fingerproxy. No code fork needed.

Use as a Library

Fingerproxy is degigned to be highly customizable. It's separated into serveral packages. Import them if you'd like to build your own fingerprinting server.

  • proxyserver listens and accepts TLS connections. It captures data that is required for fingerprinting, for example, ClientHello and certain HTTP2 frames, then stores them into metadata.
  • metadata is a struct that stores data captured by proxyserver and will be used by fingerprint.
  • fingerprint parses metadata and calculate the JA3, JA4, HTTP2 fingerprints, etc. It also implement a header_injector from reverseproxy, which allows passing fingerprints to the forwarding requests.
  • reverseproxy forwards the requests to backends. It accepts header_injectors to add request headers to the forwarding request to downstream.

A few special packages also included:

  • ja4 implements JA4 algorithm based on utls.
  • hack includes wraps and hacks of golang net stack.
  • http2 is a fork of standard http2 package in x/net. Fingerproxy syncs upstream using TODO. Follow and sync upstream whenever you want.

Similar Projects

gospider007/fp

Great implementation based on golang net stack, works nice with golang HTTP handler. Fingerproxy rewrites TLS ClientHello capturing according to it.

Why not just use it?

  • The JA3 and JA4 implementations contain bugs. For example,
    • In fp.go, _ should be used instead of , as the separator of extensions and signature algorithms.
    • In fp.go, the protocol version in ClientHello handshake should be used for JA3.
    • In ja3.go, ; should be used instead of , as the parameters separator in HTTP2 settings frame.
    • Priority frame used in HTTP2 fingerprinting has not implemented yet.
  • KISS
    • JA4H can be calculated in backend applications. Do not do it in the reverse proxy.
    • Complex design, unused methods, and copy-pastes from unknown source.
sleeyax/ja3rp

Discontinued.

h3adex/guardgress

Relies on gospider007/fp.

wwhtrbbtt/TrackMe

An HTTPS echo server that responds the fingerprints.

Why not just use it?

  • It is not designed for forwarding the requests.
  • Bugs too. In ja4.go, the padding extension (21) somehow has preserved. Therefore there would be two duplicated 21 extension which is incorrect.

Useful Websites

References

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ProxyServerLog  = log.New(os.Stderr, "[proxyserver] ", logFlags)
	HTTPServerLog   = log.New(os.Stderr, "[http] ", logFlags)
	PrometheusLog   = log.New(os.Stderr, "[metrics] ", logFlags)
	ReverseProxyLog = log.New(os.Stderr, "[reverseproxy] ", logFlags)
	FingerprintLog  = log.New(os.Stderr, "[fingerprint] ", logFlags)
	DefaultLog      = log.New(os.Stderr, "[fingerproxy] ", logFlags)

	PrometheusRegistry = prometheus.NewRegistry()

	HTTPIdleTimeout  = 180 * time.Second
	HTTPReadTimeout  = 60 * time.Second
	HTTPWriteTimeout = 60 * time.Second

	ReverseProxyFlushInterval = 100 * time.Millisecond

	GetHeaderInjectors = DefaultHeaderInjectors

	BuildCommit = "GIT_COMMIT_PLACEHOLDER"
	BuildTag    = "GIT_TAG_PLACEHOLDER"
)

Functions

func DefaultHeaderInjectors 

func DefaultHeaderInjectors() []reverseproxy.HeaderInjector

func DefaultProxyServer 

func DefaultProxyServer(handler http.Handler, tlsConfig *tls.Config, verboseLogs bool) *proxyserver.Server

func DefaultReverseProxyHTTPHandler 

func DefaultReverseProxyHTTPHandler(forwardTo *url.URL) *reverseproxy.HTTPHandler

func DefaultTLSConfig 

func DefaultTLSConfig(certFile string, keyFile string) (*tls.Config, error)

func InitFingerprint 

func InitFingerprint(verboseLogs bool)

func Run 

func Run()

func StartPrometheusClient 

func StartPrometheusClient(listenAddr string)

Types

This section is empty.

Source Files

View all Source files

Directories

Path Synopsis
example
customize-fingerprint command
pkg
fingerprint
hack
http2
Package http2 implements the HTTP/2 protocol.
 Package http2 implements the HTTP/2 protocol.
http2/h2c
Package h2c implements the unencrypted "h2c" form of HTTP/2.
 Package h2c implements the unencrypted "h2c" form of HTTP/2.
http2/h2i command
The h2i command is an interactive HTTP/2 console.
 The h2i command is an interactive HTTP/2 console.
http2/hpack
Package hpack implements HPACK, a compression format for efficiently representing HTTP header fields in the context of HTTP/2.
 Package hpack implements HPACK, a compression format for efficiently representing HTTP header fields in the context of HTTP/2.
ja3
ja4
metadata
proxyserver
reverseproxy

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.