Repolode
Submit
salesforce

salesforce/jarm

JARM is an active TLS server fingerprinting tool that sends crafted Client Hello probes to identify server configurations and spot malicious infrastructure.

View on GitHub
Stars
1,326
Forks
156
Open issues
16
Last commit
2 months ago

What is it?

JARM is an active TLS server fingerprinting tool written in Python. It sends 10 specially crafted TLS Client Hello packets to a target server, captures the attributes of the Server Hello responses, and hashes them into a 62-character fingerprint. The first 30 characters encode the cipher and TLS version chosen for each probe, and the remaining 32 are a truncated SHA256 of the extensions.

The fingerprints can be used to confirm that a group of servers shares the same TLS configuration, to cluster internet-facing servers by their setup, and to identify default software or infrastructure. Because command-and-control servers are usually configured and deployed in bulk, they often produce distinctive fingerprints that help defenders flag malicious hosts.

JARM runs from the command line for a single domain or IP, and a bundled shell script handles batch scans of large target lists. The project is the active counterpart to JA3/S, which fingerprints traffic passively.

Key features

  • 01Sends 10 crafted TLS Client Hello probes per target to capture server responses.
  • 02Produces a compact 62-character fingerprint that is easy to compare and share.
  • 03Supports single domain or IP scans and a proxy option.
  • 04Includes a shell script for batch scanning large target lists to CSV.
  • 05Requires Python 3 and is licensed under BSD-3-Clause.

Use cases

  • Checking whether a fleet of servers has a consistent TLS configuration.
  • Grouping internet servers by the software or vendor infrastructure behind them.
  • Hunting for command-and-control servers during incident response or threat research.

Quick start

  1. 1

    Install dependencies from requirements.txt

    pip install -r requirements.txt
  2. 2

    Fingerprint a domain or IP

    python3 jarm.py www.salesforce.com

Things to know

  • It actively sends probe packets to target servers, so it is not suitable for passive traffic monitoring.

Topics

#tls#fingerprinting#security#threat-intelligence#network-scanning#python

FAQ

What is jarm?
JARM is an active TLS server fingerprinting tool that sends crafted Client Hello probes to identify server configurations and spot malicious infrastructure. JARM is an active TLS server fingerprinting tool written in Python. It sends 10 specially crafted TLS Client Hello packets to a target server, captures the attributes of the Server Hello responses, and hashes them into a 62-character fingerprint. The first 30 characters encode the cipher and TLS version chosen for each probe, and the remaining 32 are a truncated SHA256 of the extensions.
Is jarm free to use? What license does it have?
jarm is open source under the BSD-3-Clause license. Check the license terms before using it in commercial products.
Is jarm still maintained?
Updated within 6 months. The last commit to jarm was on Aug 13, 2026.
What can I use jarm for?
Checking whether a fleet of servers has a consistent TLS configuration. Grouping internet servers by the software or vendor infrastructure behind them. Hunting for command-and-control servers during incident response or threat research.
How do I install jarm?
Install dependencies from requirements.txt: pip install -r requirements.txt Fingerprint a domain or IP: python3 jarm.py www.salesforce.com
Where can I get jarm?
The source code and installation instructions are on GitHub: https://github.com/salesforce/jarm

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects