{"id":23889541,"url":"https://github.com/superstes/http-fingerprint","last_synced_at":"2026-06-15T06:02:39.916Z","repository":{"id":209330720,"uuid":"723188577","full_name":"superstes/http-fingerprint","owner":"superstes","description":"Research for fingerprinting HTTP clients (security)","archived":false,"fork":false,"pushed_at":"2024-05-28T21:10:28.000Z","size":19,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"latest","last_synced_at":"2025-01-04T10:09:40.433Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://docs.o-x-l.com/waf/2_fingerprinting.html","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/superstes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-11-24T22:19:00.000Z","updated_at":"2024-09-07T10:34:52.000Z","dependencies_parsed_at":"2023-11-26T18:44:32.048Z","dependency_job_id":null,"html_url":"https://github.com/superstes/http-fingerprint","commit_stats":null,"previous_names":["superstes/http-fingerprint"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superstes%2Fhttp-fingerprint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superstes%2Fhttp-fingerprint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superstes%2Fhttp-fingerprint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/superstes%2Fhttp-fingerprint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/superstes","download_url":"https://codeload.github.com/superstes/http-fingerprint/tar.gz/refs/heads/latest","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240271529,"owners_count":19774859,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-04T10:09:45.301Z","updated_at":"2026-06-15T06:02:34.898Z","avatar_url":"https://github.com/superstes.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# HTTP Fingerprint(ing)\n\nFingerprinting can be used to identify clients that connect to your application.\n\nThis can be useful when:\n\n* Significant attacks should be detected faster\n\n* There is the need to make attack schemes easier visible\n\n* Limitations on a per-client basis need to be imposed\n\n* There are multiple clients behind a single IP and you need to differentiate them without a session (Example: [Carrier-grade NAT](https://en.wikipedia.org/wiki/Carrier-grade_NAT))\n\n* ...\n\n----\n\n## Information\n\nMore detailed information can be found here:\n\n* [Browser fingerprinting](https://github.com/niespodd/browser-fingerprinting)\n* [TLS Fingerprinting (JA3)](https://github.com/salesforce/ja3)\n* [TCP/OS Fingerprinting](https://incolumitas.com/2021/03/13/tcp-ip-fingerprinting-for-vpn-and-proxy-detection/)\n* [wiki.superstes.eu - WAF](https://wiki.superstes.eu/en/latest/1/infra/waf.html)\n* [Mozilla - Browser Fingerpinting](https://developer.mozilla.org/en-US/docs/Glossary/Fingerprinting)\n* [Javascript Fingerprinting](https://fingerprint.com/blog/browser-fingerprinting-techniques/)\n\n  * [Canvas Fingerprinting](https://fingerprint.com/blog/canvas-fingerprinting/) | [Canvas Fingerprinting #2](https://eric-diehl.com/fingerprinting-canvas-of-browser/)\n\n  * [Audio Fingerprinting](https://fingerprint.com/blog/audio-fingerprinting/)\n\n\n----\n\n## Server-Side\n\nThere is not too much server-side information that can be used to reach a good uniqueness to identify a single client across multiple IPs.\n\nBasically:\n\n* TCP/UDP Protocol\n* TLS Protocol\n* HTTP Protocol\n\n  * Application-specific headers, cookies, and so on\n\nFor more detailed information see: [wiki.superstes.eu - WAF](https://wiki.superstes.eu/en/latest/1/infra/waf.html#server-side-fingerprint)\n\n### GeoIP\n\nIP metadata can give you some information about the kind of client we might be dealing with.\n\n* [Location example](https://ipinfo.io/1.1.1.1)\n\n* [ASN example](https://ipinfo.io/AS60068)\n\nNetworks of hosting providers have a higher probability of being used for cyber attack/bot requests.\n\nSome countries are known to be used as easy/cheap sources of nodes for botnets. Per example: [Cloudflare Radar - Security](https://radar.cloudflare.com/security-and-attacks)\n\n### Sources\n\nThere are some well-known providers of good-quality GeoIP data.\n\nBut if you want to use it commercially it might get expensive fast!\n\n\n\n* [IPInfo](https://ipinfo.io/)\n\n  * [Free Databases](https://ipinfo.io/products/free-ip-database)\n\n\n* [MaxMind](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data)\n\n  * [GeoIP2](https://dev.maxmind.com/)\n  * [Free MaxMind GeoLite2](https://dev.maxmind.com/geoip/geolite2-free-geolocation-data)\n\n\n* [ipapi.is](https://github.com/ipapi-is) - quality might not be the best\n\n  * [Geolocation](https://ipapi.is/geolocation.html)\n  * [ASN](https://ipapi.is/asn.html)\n  * [Hosting](https://ipapi.is/hosting-detection.html)\n  * [FREE Databases](https://github.com/ipapi-is/ipapi/tree/main/databases)\n\nIf you are interested: Information on how to [create GeoIP databases from scratch](https://www.hackitu.de/geoip)\n\n----\n\n## Client-Side\n\nTo be continued..\n\nThis is what I want to dive into here.. (;\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperstes%2Fhttp-fingerprint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsuperstes%2Fhttp-fingerprint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsuperstes%2Fhttp-fingerprint/lists"}