JA3 / JA3S
Definition
An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software (e.g. a Cobalt Strike beacon or a specific Android version of WhatsApp) without decrypting the session.
- JA3 source
- TLS Client Hello
- JA3S source
- TLS Server Hello
- Hash type
- MD5
- Example application
- Identifying beacon or app traffic without decryption
Common questions
How are JA3 and JA3S used together in an investigation?+
JA3 identifies the client's TLS behaviour and JA3S identifies the server's response behaviour; pairing them can characterise a specific client-server handshake combination, which is useful for spotting known malware command-and-control infrastructure or fingerprinting a particular messaging app's traffic pattern.
Can an attacker evade JA3-based detection?+
Yes. Because the fingerprint depends on the client library's handshake construction, an attacker can alter or randomise those fields, a technique sometimes called JA3 evasion or randomisation, to generate a different hash on each connection and avoid matching a known blocklist.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- PCAPng
- PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...