ClientHello 扩展排列的差分隐私与 JA4 指纹伪造

#!/usr/bin/env python3
"""
ja4_extractor.py — 从 Wireshark 导出的 ClientHello 中提取 JA4 指纹
依赖: pip install dpkt
"""

import hashlib
import struct
import sys
from collections import OrderedDict

# GREASE 类型码列表（IANA 预留）
GREASE_VALUES = {
0x0a0a, 0x1a1a, 0x2a2a, 0x3a3a, 0x4a4a, 0x5a5a, 0x6a6a, 0x7a7a,
0x8a8a, 0x9a9a, 0xaaaa, 0xbaba, 0xcaca, 0xdada, 0xeaea, 0xfafa
}

defis_grease(val):
return val in GREASE_VALUES

defparse_clienthello_extensions(data, offset, length):
"""解析 ClientHello 扩展列表"""
    extensions = []
    end = offset + length
while offset < end:
if offset + 4 > len(data):
break
        ext_type = struct.unpack('!H', data[offset:offset+2])[0]
        ext_len = struct.unpack('!H', data[offset+2:offset+4])[0]
        extensions.append((ext_type, ext_len))
        offset += 4 + ext_len
return extensions

defcompute_ja4(tls_version, ciphers, extensions, alpn_list):
"""简化版 JA4 计算（仅演示核心逻辑）"""
# JA4_a: 版本 + SNI + 密码套件数量 + 扩展数量
    a_str = f"{tls_version:04x}_{len(ciphers)}_{len(extensions)}"
    ja4_a = hashlib.sha256(a_str.encode()).hexdigest()[:12]

# JA4_b: 密码套件列表（按顺序，GREASE 保留）
    b_str = ",".join(f"{c:04x}"for c in ciphers ifnot is_grease(c))
    ja4_b = hashlib.sha256(b_str.encode()).hexdigest()[:12]

# JA4_c: 扩展列表（按顺序，GREASE 保留）
    c_str = ",".join(f"{e[0]:04x}"for e in extensions)
    ja4_c = hashlib.sha256(c_str.encode()).hexdigest()[:12]

# JA4_d: ALPN 列表（按原始顺序）
    d_str = ",".join(alpn_list)
    ja4_d = hashlib.sha256(d_str.encode()).hexdigest()[:12]

returnf"{ja4_a}_{ja4_b}_{ja4_c}_{ja4_d}"

# 示例：Chrome 120 的 JA4 指纹计算
if __name__ == "__main__":
# 模拟 Chrome 120 的 ClientHello 参数
    tls_version = 0x0304# TLS 1.3
    ciphers = [0x1301, 0x1302, 0x1303, 0xc02b, 0xc02f]  # 含 GREASE
    extensions = [
        (0x002b, 5),  # supported_versions (GREASE 插入在列表中)
        (0x000a, 2),  # supported_groups
        (0x0033, 74), # key_share
        (0x002d, 2),  # psk_key_exchange_modes
        (0x000d, 28), # signature_algorithms
        (0x0010, 0),  # application_layer_protocol_negotiation
    ]
    alpn_list = ["h2", "http/1.1"]

    ja4 = compute_ja4(tls_version, ciphers, extensions, alpn_list)
    print(f"JA4: {ja4}")