Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for HTTP Request Fingerprinting #41

Closed
biandratti opened this issue Dec 17, 2024 · 0 comments · Fixed by #42
Closed

Add Support for HTTP Request Fingerprinting #41

biandratti opened this issue Dec 17, 2024 · 0 comments · Fixed by #42
Milestone

Comments

@biandratti
Copy link
Owner

biandratti commented Dec 17, 2024

Problem:
The current implementation lacks support for identifying HTTP request signatures from older browsers (e.g., MSIE5), command-line tools (e.g., curl, wget), crawlers, mobile devices, and gaming consoles. These clients often send unique User-Agent and other HTTP headers that can help identify the application and platform. However, without proper fingerprinting for these cases, the system misses the opportunity to identify older or uncommon clients, which could be essential for tasks such as traffic analysis, security, and troubleshooting.

Details:
p0f's official documentation suggests that HTTP request signatures are especially important for identifying clients like:

Older Browsers (e.g., MSIE5, Netscape Navigator).
Command-line Tools (e.g., curl, wget).
Crawlers and Bots (e.g., Googlebot, Bingbot).
Mobile Devices (e.g., iOS, Android).
Gaming Consoles (e.g., PlayStation, Xbox).
To collect accurate signatures, p0f can either run on the client system itself or analyze the traffic between the client and the web server. The goal is to capture and parse key headers in the HTTP request to identify the client application and platform.

Example from p0f:

.-[ 1.2.3.4/1524 -> 4.3.2.1/80 (http request) ]-
|
| client   = 1.2.3.4/1524
| app      = Firefox 5.x or newer
| lang     = English
| params   = none
| raw_sig  = 1:Host,User-Agent,Accept=[text/html,application/xhtml+xml...
|
`----

The goal is to implement logic that captures these specific client signatures and integrates them into the overall HTTP request fingerprinting process. The parser from database was already done.

pub struct P0fOutput {
    pub syn: Option<SynTCPOutput>,
    pub syn_ack: Option<SynAckTCPOutput>,
    pub mtu: Option<MTUOutput>,
    pub uptime: Option<UptimeOutput>,
    pub http_request: Option<HTTPRequestOutput>, // New field
}
@biandratti biandratti added this to the 0.1.0 milestone Dec 17, 2024
@biandratti biandratti linked a pull request Dec 19, 2024 that will close this issue
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant