diff --git a/docs/workshop/2-passive-ssl/d4-passivessl.tex b/docs/workshop/2-passive-ssl/d4-passivessl.tex index 96fe89d..e1a357d 100644 --- a/docs/workshop/2-passive-ssl/d4-passivessl.tex +++ b/docs/workshop/2-passive-ssl/d4-passivessl.tex @@ -139,7 +139,7 @@ Depends on libpcap. \begin{frame}[fragile] - \frametitle{sensor-d4-tls-fingerprinting - d4 client} + \frametitle{sensor-d4-tls-fingerprinting | d4 client} Required setting: \begin{itemize} \item type should be set to 2 or 254 @@ -152,12 +152,19 @@ Depends on libpcap. \begin{itemize} \item describe every TLS Sessions, \item marshal this description in JSON format - \item ship this description to D4 server + \item ship this description to the D4 server \end{itemize} \end{frame} +\begin{frame} + \frametitle{sensor-d4-tls-fingerprinting - ja3-jl plugin} + \begin{center} + \includegraphics[scale=0.4]{d4-worker2-ja3-jl.pdf} + \end{center} +\end{frame} + \begin{frame}[fragile] - \frametitle{sensor-d4-tls-fingerprinting - d4 worker} + \frametitle{sensor-d4-tls-fingerprinting - ja3-jl worker} \input{worker.tex} \begin{itemize} \item processes each reassembled JSON description, @@ -168,24 +175,26 @@ Depends on libpcap. \end{frame} \begin{frame}[fragile] - \frametitle{sensor-d4-tls-fingerprinting - d4 analyzer} - (Proof of Concept) + \frametitle{sensor-d4-tls-fingerprinting - ja3-jl analyzer} + (Work in Progress) \\ + \vspace{.8cm} + Populates a database: \begin{itemize} \item LPOP a redis list populated by the worker - \item dumbly push JSON description into a postgres database + \item push JSON descriptions into a postgres database \end{itemize} \end{frame} \begin{frame}[fragile] - \frametitle{sensor-d4-tls-fingerprinting - d4 passivessl API} - (Proof of Concept) - + \frametitle{sensor-d4-tls-fingerprinting - passivessl API} + (Work in Progress) \\ + \vspace{.8cm} Exposes a REST API to query the collected data: \begin{itemize} - \item /index : returns, the full DB :) - \item /ja3/ : returns, all TLS sessions with a given JA3 Signature - \item /ja3s/ : returns, all TLS sessions with a given JA3S Signature + \item /index : returns the full DB (PoC), + \item /ja3/ : returns all TLS sessions with a given JA3 Signature, + \item /ja3s/ : returns all TLS sessions with a given JA3S Signature, \end{itemize} \end{frame} diff --git a/docs/workshop/2-passive-ssl/d4-worker2-ja3-jl.pdf b/docs/workshop/2-passive-ssl/d4-worker2-ja3-jl.pdf new file mode 100644 index 0000000..118fb30 Binary files /dev/null and b/docs/workshop/2-passive-ssl/d4-worker2-ja3-jl.pdf differ