Lion Cipher Lab
Fingerprint C2 servers with JARM to cluster malicious infrastructure
- Threat Intel Analyst
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A huge amount of threat-intelligence work is not about a single malicious IP — it is about finding the OTHER servers that belong to the same actor before they are used against you. That is infrastructure pivoting, and it lives near the top of the Pyramid of Pain: if you can cluster and burn an adversary's whole tooling footprint, you cost them far more than blocking one address. JARM is one of the cleanest ways in. It is an ACTIVE TLS server fingerprint: you send a server ten deliberately-varied TLS handshakes and hash the pattern of how it answers, producing a 62-character fingerprint of…
What you'll learn
- understanding what ACTIVE TLS server fingerprinting is — probing a server and hashing how it responds
- the core distinction: JA3/JA4 fingerprint the CLIENT (passive, off a PCAP); JARM fingerprints the SERVER (active, sends packets)
- installing jarm (pip install jarm, or clone salesforce/jarm and run jarm.py)
- running jarm.py against public HTTPS hosts you are authorized to probe and reading the 62-character fingerprint
- understanding how the 62-char hash is built (30 chars of cipher/version choices + 32-char truncated SHA-256 of extensions)
- reasoning about why IDENTICAL JARM hashes CLUSTER servers with the same TLS stack/config
- why default-configured C2 frameworks (Cobalt Strike, Metasploit, Covenant) are trivially clustered by JARM
- the false-cluster trap: CDN-fronted, domain-fronted and shared-hosting servers share a provider's JARM
- judgment: active scanning sends packets and can be logged/detected — unlike passive JA3 read off a capture
- the authorization/ethics boundary: only fingerprint hosts you own or public infra you are authorized to probe
Steps in this lab
- The idea: cluster the infrastructure, not the indicator
- Active vs passive, and CLIENT vs SERVER — the distinction that keeps this from being a JA3 rerun
- Set the authorization boundary before you send a single packet
- Install JARM
- Fingerprint your first host and read the 62 characters
- Fingerprint a few more hosts and watch them cluster (or not)
- The false-cluster trap: CDNs, domain fronting and shared hosting
- Scale it up the RIGHT way: pivot in Censys/Shodan instead of scanning the internet yourself
- The judgment: never single-signal, and mind that you left tracks
- What you built, and where it plugs in