Extension {{ 17513 }} is not Supported

[White2001Offl]

Description

I get this Extension {{ 17513 }} is not Supported from this JA3 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0

Issue Type

Support

Operating System

Windows 10, Mac OS

Node Version

Node 16.x

Golang Version

Go 16.x

Relevant Log Output

-> \nGet \"https://ja3er.com/json\": Extension {{ 17513 }} is not Supported by CycleTLS please raise an issue

[Danny-Dasilva]

@89z Do you know of a more reputable site for pulling ja3 hashes, ideally one that's open source or a good method to implement that. Happy to spend the time developing this because I agree, ja3er is pointing people in the wrong direction and is often causing more issues than its worth.

[Danny-Dasilva]

Good to know, I'll look into creating something. Most likely a normal and HTTP/2 version of the site is needed. I'll reach out if I need anything.

[ghost]

Hello, this is the JA3 fingerprint of Google Chrome. This extension is not IANA assigned, but comes from BoringSSL. It is known as "extensionApplicationSettings" in the code.

[ghost]

Hello, this is the JA3 fingerprint of Google Chrome. This extension is not IANA assigned, but comes from BoringSSL. It is known as "extensionApplicationSettings" in the code.

@cuteacc please link directly to the code in question. Please don't make other people find their own references.

@Danny-Dasilva in these cases, I add those as GenericExtension:

https://github.com/89z/format/blob/v1.29.6/crypto/parse.go#L102-L108

although again, I wouldn't make any change until we have a proper reference, which we don't yet.

Apologies, this is where it is defined as 17513, and here is their implementation of it. It is for ALPS, a HTTP/2 and HTTP/3 feature.

[Danny-Dasilva]

Extension 17513 is now supported as of this release. Ja3er does not properly return this extension due to it's known issues. However sites like https://tls.peet.ws/api/clean and Wireshark should verify that we are returning 17513.

[Danny-Dasilva]

I do not, looking into how to implement this though

[Danny-Dasilva]

Thanks for this, I'll most likely modify this to run tests against internally

[Danny-Dasilva]

FYI, I spoke with developer for https://tls.peet.ws - they have open sourced that server as well:

https://github.com/wwhtrbbtt/TrackMe

Thanks a lot, super appreciated 👍