Threat IntelligenceApr 19, 202613 min read

TLS Fingerprint Spoofing & WAF Bypass

Modern Web Application Firewalls (Cloudflare, AWS WAF, Akamai, Imperva) no longer rely solely on IP reputation and User-Agent headers to detect automated bots. Today, the cornerstone of bot management is TLS Fingerprinting (JA3, JA4, JA4+). Understanding how TLS fingerprints are constructed — and how advanced stressers spoof them — is vital for securing high-traffic APIs.

Technical Concept: During the initial TLS handshake, the client sends a `ClientHello` packet containing supported ciphers, extensions, elliptic curves, and ALPN protocols. The specific ordering and values produce a cryptographic hash that uniquely identifies the client software stack (e.g. Python cURL vs Google Chrome).

JA3 vs JA4 Fingerprint Architecture

JA3 was created in 2017 by Salesforce researchers. In 2023, FoxIO released JA4, which provides modular, human-readable fingerprinting:

Metric	JA3 Fingerprint	JA4 Fingerprint
Format	MD5 hash of concatenated integers	Structured 36-character string
Protocol Inspection	TLS Version, Ciphers, Extensions, Curves	TCP/QUIC + TLS Version + SNI + Ciphers + Extensions + ALPN
GREASE Resilience	Fails on randomized GREASE values	Ignores GREASE to maintain stable hashes
Sample Hash	cd08e31494f9531f560d64cfa3f2211f	t13d1516h2_8daaf6152771_b5e5207e5f33

Decoding the JA4 Fingerprint String Structure

Unlike JA3's opaque 32-character MD5 hash, JA4 produces a human-readable 36-character fingerprint divided into three distinct segments: a_b_c:

JA4 Segment	Format & Meaning	Example (Chrome 124)
Segment A (Protocol & Handshake)	Protocol (t/q) + TLS version (13) + SNI (d/i) + Cipher count + Ext count + ALPN	t13d1516h2
Segment B (Cipher Hash)	First 12 characters of SHA-256 of sorted hex ciphers	8daaf6152771
Segment C (Extensions Hash)	First 12 characters of SHA-256 of sorted extensions + signature algorithms	b5e5207e5f33

How Advanced Stressers Spoof Genuine Browser JA4 Hashes

A standard Python or Go HTTP client produces an immediate dead giveaway:

python-requests uses OpenSSL with default cipher ordering and no HTTP/2 ALPN, producing a known bot hash.
Boota Cloudflare Bypass Engine utilizes custom modified BoringSSL/uTLS implementations that precisely replicate Google Chrome 124+ or Safari 17.4 ClientHello frames, including randomized GREASE values, extension orderings, and HTTP/2 SETTINGS pseudo-headers.

TLS 1.3 0-RTT Early Data Replay Vulnerabilities

TLS 1.3 introduced 0-RTT (Zero Round Trip Time) connection resumption to speed up page loads for returning visitors. However, because 0-RTT data can be replayed by an adversary without cryptographic renegotiation, attackers can replay non-idempotent HTTP POST requests to overwhelm backend payment or inventory databases.

Frequently Asked Questions (FAQ)

What are GREASE values in TLS?

Generate Random Extensions And Sustain Extensibility (GREASE) is an IETF mechanism where browsers inject randomized dummy values into TLS handshakes to prevent middleboxes from breaking when new TLS features are introduced.

Can an attacker bypass JA4 by changing User-Agent?

No. JA4 is computed entirely from the binary cryptographic handshake before any HTTP headers (like User-Agent) are transmitted.

Related Technical Guides

Layer 7