Analysing encrypted traffic without decrypting it
With JA3, JA4 and JA4S fingerprints, certificate anomalies, SNI, ECH and DoH metadata you single out the suspicious without seeing inside encrypted channels.
Level 401 · 14 lessons · 12 practice labs
Lessons
Fingerprints
- JA3 and JA3S: client and server handshake fingerprints
- The JA4 family: JA4, JA4S, JA4H and JA4X
- Building the organisation’s normal fingerprint inventory
- The limits of fingerprints: collisions and mimicry
- Short task: find client fingerprints seen only once in a capture
Metadata signals
- Certificate anomalies: newly registered domains, short lifetimes, empty fields
- SNI and Encrypted Client Hello (ECH): how visibility changes
- Detecting clients using DNS over HTTPS
- Recognising applications from packet size and timing patterns
- Short task: list hosts using encrypted DNS against company policy
In practice
- What remains visible in QUIC traffic
- TLS inspection: benefits, risks and legal limits
- Reporting an encrypted traffic finding with its level of confidence
- Capstone: find a command channel hidden in encrypted traffic using metadata only
Practice labs
- Extract JA3 and JA3S values: List the client and server fingerprints of the TLS sessions in a capture.
- Fingerprints seen only once: Count client fingerprints and report those seen on only one host with their destinations.
- Build a normal fingerprint inventory: Build a JA4 inventory from a week of Mercanköşk Otelcilik network capture and flag those outside it in the new week.
- Find certificates with empty fields: List the certificates whose subject or issuer field is empty or left at default values.
- Short-lived and brand-new certificates: Report certificates with a very short validity or issued in the last three days with their server names.
- Tell apart a fingerprint collision: Tell apart two different applications sharing one JA3 value using certificate, SNI and timing information.
- List the sessions without SNI: Find the TLS sessions carrying no server name and count their destination addresses.
- Hosts using encrypted DNS: List the hosts using DoH or DoT against organisation policy with the evidence.
- How much visibility changes with ECH: Compare captures with and without ECH and tabulate the fields that disappear and those still visible.
- Count what stays visible in QUIC: Extract version, server name and connection duration from QUIC sessions.
- Recognise the application from packet sizes: From size and timing patterns of three encrypted sessions decide which is video, file upload and interactive session.
- Find the command channel with metadata only: In a prepared capture, without decrypting, find the hidden channel by fingerprint, certificate and timing and report it with a stated confidence level.
About this course
With JA3, JA4 and JA4S fingerprints, certificate anomalies, SNI, ECH and DoH metadata you single out the suspicious without seeing inside encrypted channels.
What you will learn
- Fingerprints
- Metadata signals
- In practice
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.