Skip to content

Sift 2.1.0

Choose a tag to compare

@olasted olasted released this 15 Oct 13:34
· 8 commits to main since this release

Adds TLS fingerprint impersonation and the Jar.

TLS fingerprints. Every request the Sender and Jar send can impersonate a real client's TLS
and HTTP/2 fingerprint, using tls-client. Pick from
83 profiles — Chrome, Firefox, Safari (desktop and iOS), Edge, Opera, Brave, OkHttp. A route
carries a default; the toolbar dropdown overrides it per tab.

It changes what the server actually sees:

Go default chrome_131
JA3 d6627faa72aa91c9e2ae51d456173c69 a19ab9f02aacf42deddc1f2acb3d3f63
JA4 t13d2512h2_b78ed14e2fd0_ab7e3b40a677 t13d1516h2_8daaf6152771_02713d6af862

Headers also go out in the order you typed them, passed through to HTTP/2 as the header order.
A Chrome JA3 with Go's alphabetical header order still reads as a bot, so both halves matter.
Works through every route, including an upstream HTTP or SOCKS5 proxy and Sift's own proxy.
Routes can also force HTTP/1.1.

Jar. A new tab that takes a URL and shows you everything about its cookies. It walks the
redirect chain keeping a jar like a browser would, and per hop shows the cookies sent, the
Set-Cookie headers received with domain, path, expiry and flags, and both header sets. The
Find box searches all of that at once, as plain text or regex, and says where each hit came
from. Every hop is also a normal row in the Traffic tab.

The binary is 18 MB now, up from 11.5 MB — that is the cost of utls and quic-go.

SHA-256: 35b4ffc51cb1c5fc1877d3c9c1f2bc9fae6d78ae19ac075916da086b855b007e

Windows x64. MIT.