Feature #2698
closed
hassh and hasshServer for ssh fingerprinting
Added by Victor Julien about 6 years ago.
Updated over 4 years ago.
Description
As discussed at Suricon2018, it would be great to have JA3 for non-https as well. This ticket is for SSH.
The SSH parser currently doesn't really inspect the handshake, so it will be a bit of work probably.
- Related to Task #2685: SuriCon 2018 brainstorm added
The JA3 equivalent for SSH is called hassh (and hasshServer for JA3s):
https://github.com/salesforce/hassh
It would force me to learn some Rust, so it's a nice little project I think :)
- Subject changed from ja3/ja3s for ssh to hassh and hasshServer for ssh fingerprinting
- Status changed from Assigned to Closed
- Assignee changed from Mats Klepsland to Vadym Malakhatko
- Target version changed from TBD to 6.0.0beta1
- Effort deleted (
medium)
- Difficulty deleted (
medium)
Also available in: Atom
PDF