JARM TLS server fingerprint
ID jarm_fingerprint
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
Fingerprint of a TLS server, created at Salesforce in 2020 and computed by actively sending it ten crafted ClientHello messages. It is 62 lowercase hexadecimal digits: the first 30 encode the cipher (two digits) and TLS version (one digit, 0 or a-f) that the server chose for each of the ten handshakes, with 000 for a refused handshake, and the last 32 are a truncated SHA-256 hash of the extensions and ALPN values it returned. A server that answers none of them gets 62 zeros. Shodan, Censys and VirusTotal (jarm attribute of domains and IP addresses) report it, and it is used to find malware command-and-control servers. Servers with the same software and configuration share a JARM.
- Categories
- Internet
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^(?:[0-9a-f]{2}[0a-f]){10}[0-9a-f]{32}$Python re syntax.
Examples
| Value | Description |
|---|---|
| 27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d | google.com (JARM README; also the example in the VirusTotal domain object) |
| 2ad2ad0002ad2ad00042d42d00000069d641f34fe76acdc05c40262f8815e5 | salesforce.com, with refused handshakes (JARM README) |
| 07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1 | Cobalt Strike command-and-control server (JARM README) |
| 27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d00 invalid | 64 digits, the length of a full SHA-256 hash |
Sources
- doc: https://github.com/salesforce/jarm
- other: https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
- other: https://virustotal.readme.io/reference/domains-object
Use this record
- Page URL:
https://registry.apicrafter.io/datatype/jarm_fingerprint - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/internet/jarm_fingerprint.yamlon GitHub