jgaunt/CyberChef
2
0
Fork 0
mirror of https://github.com/gchq/CyberChef synced 2025-12-23 11:43:39 +00:00
Code Issues Releases Wiki Activity

Fixed JA4 version fallback value

Browse Source
This commit is contained in:
n1474335
2024-08-14 15:21:57 +01:00
parent a477f47aec
commit 7a5225c961
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/core/lib/JA4.mjs
View File

@@ -44,7 +44,7 @@ export function toJA4(bytes) {
the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet) the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
should be ignored. should be ignored.
*/ */
let version = tlsr.version.value; let version = tlsr.handshake.value.helloVersion.value;
for (const ext of tlsr.handshake.value.extensions.value) { for (const ext of tlsr.handshake.value.extensions.value) {
if (ext.type.value === "supported_versions") { if (ext.type.value === "supported_versions") {
version = parseHighestSupportedVersion(ext.value.data); version = parseHighestSupportedVersion(ext.value.data);
@@ -189,7 +189,7 @@ export function toJA4S(bytes) {
the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet) the TLS version is the value of the Protocol Version. Handshake version (located at the top of the packet)
should be ignored. should be ignored.
*/ */
let version = tlsr.version.value; let version = tlsr.handshake.value.helloVersion.value;
for (const ext of tlsr.handshake.value.extensions.value) { for (const ext of tlsr.handshake.value.extensions.value) {
if (ext.type.value === "supported_versions") { if (ext.type.value === "supported_versions") {
version = parseHighestSupportedVersion(ext.value.data); version = parseHighestSupportedVersion(ext.value.data);