Advanced Labs
Intermediate JA4T Lab 2

JA4T Practice Labs Using Wireshark, Driftnet, JA4DB, and Terminal.js

This comprehensive guide provides step-by-step practice labs designed to help you understand and apply JA4T fingerprinting using various tools. The labs are categorized into Beginner, Intermediate, and Expert levels.

Table of Contents

  • Beginner Lab
    • Capturing TCP SYN Packets with Wireshark
  • Intermediate Lab
    • Analyzing JA4T Fingerprints with Driftnet and JA4DB
  • Expert Lab
    • Building a Real-Time JA4T Monitoring Tool with Terminal.js and JA4DB

Beginner Lab

Objective

Learn how to capture TCP SYN packets using Wireshark and generate JA4T fingerprints to identify TCP client behaviors.

Tools Required

  • Wireshark: A network protocol analyzer used for network troubleshooting, analysis, and education.

Prerequisites

  • Basic understanding of TCP/IP networking.
  • Administrative access to install and run Wireshark on your machine.

Lab Steps

Step 1: Install Wireshark

  • Download Wireshark:
    • Navigate to the Wireshark Download Page.
    • Choose the appropriate installer for your operating system (Windows, macOS, Linux).
  • Install Wireshark:
    • Run the installer and follow the on-screen instructions.
    • For Windows users, ensure you install the "NPcap" packet capture library when prompted.

Step 2: Launch Wireshark and Select Network Interface

  • Open Wireshark:
    • Double-click the Wireshark icon to launch the application.
  • Select Network Interface:
    • On the main screen, you will see a list of available network interfaces.
    • Choose the interface that is connected to the internet (e.g., Ethernet, Wi-Fi).

Step 3: Apply a Capture Filter for TCP SYN Packets

  • Open Capture Options:
    • Click on the interface name to start capturing packets.
  • Apply Capture Filter:

    • In the capture filter bar at the top, enter the following filter to capture only TCP SYN packets:

      tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0

    • This filter captures packets where the SYN flag is set, and the ACK flag is not set.

Step 4: Start Packet Capture

  • Begin Capturing:
    • Click the Shark Fin icon or press Ctrl + E to start capturing packets.
  • Generate Network Traffic:
    • Open a web browser or any network-enabled application to initiate new TCP connections.
    • For example, navigate to a website you haven't visited recently.

Step 5: Stop Packet Capture

  • Stop Capturing:
    • After generating some traffic, click the Red Square icon or press Ctrl + E again to stop capturing packets.

Step 6: Analyze Captured Packets

  • Filter Displayed Packets:

    • In the display filter bar (located just below the toolbar), enter:

      tcp.flags.syn == 1 && tcp.flags.ack == 0

    • Press Enter to apply the filter. This shows only TCP SYN packets initiating connections.

  • Examine Packet Details:
    • Click on a packet in the list to view its details.
    • Expand the Transmission Control Protocol section to see TCP header details.

Step 7: Extract TCP Options and Header Information

  • Locate TCP Options:
    • In the Transmission Control Protocol section, find the Options field.
    • Expand the Options to see the list of TCP options included in the packet.
  • Record TCP Options:
    • Note down the options and their order. Common options include:
      • Maximum Segment Size (MSS)
      • Window Scale
      • Selective Acknowledgments (SACK Permitted)
      • Timestamps
  • Record Window Size and TTL:
    • Window Size Value: Located under the TCP header.
    • TTL (Time To Live): Found in the Internet Protocol Version 4 section as Time to live.

Step 8: Construct the JA4T Fingerprint

  • Format the Fingerprint:

    • Use the structure:

      f<tcp_flags>_o<tcp_options_hash>_ws<window_size>_ttl<ttl>_ip<ip_options_hash>

  • Determine TCP Flags:

    • For a SYN packet, the flag is S.

  • Hash TCP Options:

    • For simplicity, concatenate the option kinds in order and compute a hash (e.g., MD5 or SHA1).

      Example: If options are MSS, SACK Permitted, Timestamps, Window Scale, you might represent them as [2, 4, 8, 3].

      Use an online hash calculator or write a simple script to compute the hash.

      import hashlib
options = [2, 4, 8, 3]
options_bytes = bytes(options)
options_hash = hashlib.sha1(options_bytes).hexdigest()[:5]
print(options_hash)

  • Hash IP Options:

    • If there are no IP options, use 000.

  • Assemble the Fingerprint:

    • Suppose:

      • TCP Flags: S
      • TCP Options Hash: a1b2c
      • Window Size: 65535
      • TTL: 128
      • IP Options Hash: 000

    • The JA4T fingerprint would be:

      fS_oa1b2c_ws65535_ttl128_ip000

Step 9: Interpret the Fingerprint

  • Identify the Operating System:
    • Certain TCP option patterns and window sizes are indicative of specific operating systems.
    • For example, a window size of 65535 and TTL of 128 often correspond to Windows machines.
  • Compare with Known Fingerprints:
    • Visit JA4DB to compare your fingerprint with known profiles.

Step 10: Document Your Findings

  • Create a Report:
    • Summarize the steps you took and the fingerprint you generated.
    • Include screenshots of Wireshark where relevant.
  • Reflect on the Exercise:
    • Consider what the fingerprint tells you about the client.
    • Think about how this information could be used in network security.

Intermediate Lab

Objective

Use Driftnet and JA4DB to analyze captured network traffic, extract JA4T fingerprints, and identify patterns or anomalies in TCP client behaviors.

Tools Required

  • Driftnet: A network traffic analyzer that can extract and display images and other data from network traffic.
  • Access to JA4DB: An online database of JA4T fingerprints.
  • Wireshark (optional): For capturing network traffic if needed.

Prerequisites

  • Completion of the Beginner Lab or equivalent experience.
  • Familiarity with basic command-line operations.
  • Internet access to use Driftnet and JA4DB.

Lab Steps

Step 1: Install Driftnet

  • For Linux Users:

    • Open a terminal.

    • Install Driftnet using your package manager:

      sudo apt-get install driftnet

      or

      sudo yum install driftnet

  • For macOS Users:

    • Use Homebrew to install Driftnet:

      brew install driftnet

  • For Windows Users:

    • Driftnet is primarily designed for Unix-like systems. Consider using a Linux virtual machine or WSL (Windows Subsystem for Linux).

Step 2: Capture Network Traffic

  • Run Driftnet:

    • You may need to run Driftnet with administrative privileges to capture packets.

    • Execute:

      sudo driftnet -i <interface>

    • Replace <interface> with your network interface (e.g., eth0, wlan0).

  • Monitor Traffic:
    • Driftnet will start capturing images and data from the network traffic.
    • For this lab, we are interested in the data Driftnet collects about TCP sessions.

Step 3: Extract JA4T Fingerprints

  • Modify Driftnet to Extract JA4T:
    • Since Driftnet's default functionality is image extraction, we'll use a modified version or a script that utilizes Driftnet's capabilities to extract JA4T fingerprints.
    • Alternatively, use a tool like Bro/Zeek or write a script to parse pcap files.
  • Capture Traffic to a File:

    • Instead of real-time analysis, capture traffic to a pcap file using tcpdump:

      sudo tcpdump -i <interface> -w capture.pcap

    • Generate network traffic as before, then stop the capture with Ctrl + C.

  • Process the pcap File:

    • Use a script or tool to extract TCP SYN packets and compute JA4T fingerprints.

      from scapy.all import rdpcap, TCP
 
packets = rdpcap('capture.pcap')
for packet in packets:
        if packet.haslayer(TCP) and packet[TCP].flags == 'S':
                tcp_options = packet[TCP].options
                window_size = packet[TCP].window
                ttl = packet.ttl
                # Compute JA4T fingerprint
                fingerprint = compute_ja4t(tcp_options, window_size, ttl)
                print(f"JA4T Fingerprint: {fingerprint}")

      Implement the compute_ja4t function as per your understanding from the Beginner Lab.

Step 4: Analyze Fingerprints with JA4DB

  • Access JA4DB:
    • Go to JA4DB in your web browser.
  • Search for Fingerprints:
    • Enter the JA4T fingerprints you obtained into the search bar.
    • Review the results to see if they match known client profiles.
  • Interpret the Results:
    • Identify the operating systems or applications associated with the fingerprints.
    • Note any fingerprints that do not match known profiles, as these may indicate anomalies or new clients.

Step 5: Identify Patterns and Anomalies

  • Aggregate Fingerprints:
    • If you have multiple fingerprints, create a list or table to organize them.
  • Look for Commonalities:
    • Group fingerprints by similar attributes (e.g., same TCP options hash, window size, TTL).
  • Spot Anomalies:
    • Highlight fingerprints that deviate from the common patterns.
    • Investigate these further to determine if they represent unknown or suspicious clients.

Step 6: Document Your Findings

  • Create a Detailed Report:
    • Include the methods used for extraction and analysis.
    • Present your organized data with any patterns or anomalies highlighted.
  • Reflect on Security Implications:
    • Consider how the identified anomalies could impact network security.
    • Propose steps to monitor or mitigate potential threats.
Capturing Traffic: JA4HIntermediate Lab 1