JARM

Active TLS fingerprinting using JARM.

Data Enrichment & Threat Intelligence · JARM

Details

IDJARM
ProviderSalesforce
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/py3-tools:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Active TLS fingerprinting using JARM

Configure JARM in Cortex

Parameter Required
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

jarm-fingerprint

Calculate JARM fingerprint by scanning host with multiple TLS packets.

Base Command

jarm-fingerprint

Input

Argument Name Description Required
host FQDN or IP address to fingerprint. Also supports [https://fqdn:port] format. Required
port Port to fingerprint. If provided overrides the port specified in the host parameter. Default is 443. Optional

Context Output

Path Type Description
JARM.FQDN String FQDN of the host.
JARM.IP String IP Address of the host.
JARM.Port Number TCP port
JARM.Target String The host in the format [IP or FQDN]:Port
JARM.Fingerprint String JARM fingerprint of the host.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!jarm-fingerprint host="google.com" port=443

Context Example

{
    "DBotScore": [
        {
            "Indicator": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d",
            "Score": 0,
            "Type": "jarm",
            "Vendor": "JARM"
        }
    ],
    "JARM": {
        "FQDN": "google.com",
        "Fingerprint": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d",
        "Port": 443,
        "Target": "google.com:443"
    }
}

Human Readable Output

Results

FQDN Fingerprint Port Target
google.com 27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d 443 google.com:443

Configuration parameters

  • proxy — Use system proxy settings

Commands (1)

  • jarm-fingerprint

    Calculate JARM fingerprint by scanning host with multiple TLS packets.

Source

JARM.py JARM_test.py JARM.yml JARM_description.md command_examples.txt
Download History Raw 
def test_parse_fqdn_implicit_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "google.com"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}:{MOCK_PORT!s}"
    port = None

    assert parse_hostname(hostname=hostname, port=port) == {
        "target_type": "fqdn",
        "target_host": MOCK_HOSTNAME,
        "port": MOCK_PORT,
    }


def test_parse_fqdn_noport(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "google.com"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}"
    port = None

    assert parse_hostname(hostname=hostname, port=port) == {
        "target_type": "fqdn",
        "target_host": MOCK_HOSTNAME,
        "port": MOCK_PORT,
    }


def test_parse_fqdn_explicit_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "google.com"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}"
    port = MOCK_PORT

    assert parse_hostname(hostname=hostname, port=port) == {
        "target_type": "fqdn",
        "target_host": MOCK_HOSTNAME,
        "port": MOCK_PORT,
    }


def test_parse_fqdn_explicit_port_wins_over_implicit(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "google.com"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}:999"
    port = MOCK_PORT

    assert parse_hostname(hostname=hostname, port=port) == {
        "target_type": "fqdn",
        "target_host": MOCK_HOSTNAME,
        "port": MOCK_PORT,
    }


def test_parse_ipv4_implicit_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "1.2.3.4"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}:{MOCK_PORT}"
    port = None

    assert parse_hostname(hostname=hostname, port=port) == {"target_type": "ip", "target_host": MOCK_HOSTNAME, "port": MOCK_PORT}


def test_parse_ipv4_explicit_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "1.2.3.4"
    MOCK_PORT = 443

    hostname = f"{MOCK_HOSTNAME}"
    port = MOCK_PORT

    assert parse_hostname(hostname=hostname, port=port) == {"target_type": "ip", "target_host": MOCK_HOSTNAME, "port": MOCK_PORT}


def test_parse_url_with_fqdn_and_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "google.com"
    MOCK_PORT = 443

    hostname = f"https://{MOCK_HOSTNAME}:{MOCK_PORT}"
    port = None

    assert parse_hostname(hostname=hostname, port=port) == {
        "target_type": "fqdn",
        "target_host": MOCK_HOSTNAME,
        "port": MOCK_PORT,
    }


def test_parse_url_with_ip_and_port(mocker):
    from JARM import parse_hostname

    MOCK_HOSTNAME = "1.2.3.4"
    MOCK_PORT = 443

    hostname = f"https://{MOCK_HOSTNAME}:{MOCK_PORT}"
    port = None

    assert parse_hostname(hostname=hostname, port=port) == {"target_type": "ip", "target_host": MOCK_HOSTNAME, "port": MOCK_PORT}


def test_jarm_fingerprint(mocker):
    from JARM import Client, jarm_fingerprint_command

    MOCK_HOST = "google.com"
    MOCK_PORT = "443"
    MOCK_FINGERPRINT = "27d40d40d29d40d1dc42d43d00041d132f09251ceeb363bb0349f742bf0947"

    mocker.patch("jarm.scanner.scanner.Scanner.scan_async", return_value=(MOCK_FINGERPRINT, MOCK_HOST, int(MOCK_PORT)))
    client = Client()
    args = {"host": MOCK_HOST, "port": MOCK_PORT}
    response = jarm_fingerprint_command(client, args)

    mock_response = {
        "FQDN": MOCK_HOST,
        "Port": int(MOCK_PORT),
        "Fingerprint": MOCK_FINGERPRINT,
        "Target": f"{MOCK_HOST}:{int(MOCK_PORT)}",
    }

    assert response.outputs == mock_response