Founder & CTO at FoxIO Inventor of the JA4+ network fingerprinting suite. Also, JA3/S (TLS) HASSH (SSH) CYU (QUIC) JARM (TLS Servers)
NoVAH
Joined April 2010
- Tweets1K
- Following226
- Followers3.5K
- Likes530
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
The private keys for the eMudhra CA were compromised yesterday. Here's all the IPs likely hosting fake eMudhra certificates. These were found using JA4X on hunt.io but you can do the same thing on Censys, Xpanse, Validin, or any other tool running JA4+
This hunt was easy. JA4X is effectively a fingerprint of the tool which produces the certificate. Certificate Authorities use the same set of tools to sign their certificates. So they end up having a small set of JA4X fingerprints.
Introducing JA4Scan, the latest addition to JA4+
JA4Scan is available now and built into (or coming soon to) all of the tools you already use including Censys, Palo Alto Networks, Hunt, SecurityScorecard, Modat, Validin, and more.
foxio.io/blog/introducing-ja…
! JA4 Bug Fix - Please Update !
The Zeek, Arkime, Wireshark, and Rust implementations of JA4 did not appropriately ignore GREASE values in the signature algorithms extension - meaning these tools produced incorrect JA4 fingerprints for Chromium and other Google-based programs.
Devs of other tools running JA4, check to make sure you're ignoring GREASE values in signature algorithms. GREASE values should be ignored everywhere.
JA4+ for Zeek has been upgraded from Zeek Scripts to a Zeek C++ Plugin for significant performance improvements! To Install:
zkg install zeek/foxio/ja4
If you already have ja4 installed via zkg:
zkg upgrade zeek/foxio/ja4
Thanks to: INL, BEA, SEI
github.com/FoxIO-LLC/ja4/tre…
Zeek 7.0+, C++20 compiler (Clang 19+ or GCC 12+), and CMake 3.15+ are required.
If you're on Zeek 5.0+, the Zeek scripts-only are still available here:
github.com/FoxIO-LLC/ja4-zee…
New 0-day in XQUIC - the HTTP/3 library. Just a few packets can take down load balancers and web servers!
In the blog are JA4Scan links which will show you if XQUIC is running in your environment.
foxio.io/blog/xring-crashing…
I am a BMW CCA Track Instructor and have been instructing for over 10 years
Top car mods we recommend to students:
Beginner -- no mods, drive it as-is
Lower Intermediate -- Brake pads
Upper Intermediate -- ^^ + Tires and Camber Plates
Advanced -- ^^ + Suspension
Advanced Solo -- ^^ + Seats, Harnesses and Tune
Instructor Candidate -- ^^ + Aero and Cage
Instructor -- No mods, drive it as-is
John Althouse retweeted
Validin now supports JA4X fingerprinting, brought to you by @4A4133 (the creator of JARM), and more JA4+ fingerprints are on the way!
Read our announcement here:
validin.com/blog/validin_sup…
John Althouse retweeted
👀 React2Shell attacker profiles fresh from GreyNoise telemetry: info.greynoise.io/hubfs/PDFs…, don't miss the latest contribution from GreyNoise Labs on React2Shell: labs.greynoise.io/grimoire/2…
#React2Shell #Nextjs #CVE202555182 #CVE #GreyNoise
Introducing JA4D and JA4D6: DHCP Fingerprinting! Know what's on your network the moment a device is plugged in, regardless of MAC address and without the need for network scanning.
Available now for Wireshark, Zeek, and Arkime, coming to other tools like Suricata, Nzyme and Vectra soon!
foxio.io/blog/ja4d-and-ja4d6…
John Althouse retweeted
Give it up for FoxIO, a Community Friend Sponsor for #SuriCon2025! FoxIO’s JA4™ and JA4+™ are the industry’s most advanced network fingerprinting standards. We are thankful to have them backing #SuriCon and #Suricata!
Check them out! foxio.io/
@4A4133
