Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog

TL;DR JARM is an active Transport Layer Security (TLS) server fingerprinting tool. Scanning with JARM provides the ability to identify and group malicious servers on the Internet. JARM is available here: https://github.com/salesforce/jarm JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration.Group disparate servers on the internet by configura

[teddy-g]

TLSのServer HelloのFingerprintを用いてCobaltStrikeとか使ったC2サーバーを見つけるスキャナ、JARMの解説。Shodan、Censys、SecurityTrailsとかも対応済みとか。

[hiboma]

TLS, fingerprint, fuzzy hash /// ミドルウェア・TLS 設定が同一かどうかを調べたり