ja4 - add another test

astibal · Nov 11, 2024 · beb1994 · beb1994
1 parent 5c219dc
commit beb1994
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/src/inspect/tests/http1_tests.cpp b/src/inspect/tests/http1_tests.cpp
@@ -63,6 +63,21 @@ struct {
         const char* JA4H_r_3 = "ge11cr04da00_Host,User-Agent,Accept,Accept-Language_tasty_cookie,yummy_cookie_tasty_cookie=strawberry,yummy_cookie=choco";
         const char* JA4H_3 = "ge11cr04da00_8ddaef5d77af_280f366eaa04_c2fb0fe53442";
 
+        const std::string cookie1 = "GET /socket.io/1/websocket/a4ed08e8bdd5860-4c7c773809d08918?sr=RU4AAPsgsB6hsEG29EqDnVO_UUy_T8uFRvOpiExD3gtRAMNPqsn0NYKhmA7_BpdNH93WG2w5NSakd5hpgg1ItbwFjQpZI14BkUofLWUvfgMzReWKpCY&issuer=prod-2&sp=connect&se=1731783638678&st=1731231714678&sig=DdPT0f2rZFfcHU_yo6e-HyjM4T5AAFoZdE8MBejpV2A&v=v4&tc={\"cv\":\"2024.04.01.1\",\"ua\":\"TeamsCDL\",\"hr\":\"\",\"v\":\"27/1.0.0.2024101502\"}&timeout=40&auth=true&epid=9f1ee57c-e3b5-44aa-80d5-b3e8790b41f3&userActivity={\"state\":\"active\",\"cv\":\"1BOskXVyJDCrCpIoleijMA.1\"}&ccid=DnVO_UUy_Tw&cor_id=64b0c3df-cc8e-4f38-a8f1-f856aba042a7&con_num=1731232014533_34 HTTP/1.1\r\n"
+                                    "Host: pub-ent-plce-05-t.trouter.teams.microsoft.com\r\n"
+                                    "Connection: Upgrade\r\n"
+                                    "Pragma: no-cache\r\n"
+                                    "Cache-Control: no-cache\r\n"
+                                    "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) MicrosoftTeams-Preview/1.5.00.23861 Chrome/85.0.4183.121 Electron/10.4.7 Safari/537.36\r\n"
+                                    "Upgrade: websocket\r\n"
+                                    "Origin: https://teams.microsoft.com\r\n"
+                                    "Sec-WebSocket-Version: 13\r\n"
+                                    "Accept-Encoding: gzip, deflate, br\r\n"
+                                    "Accept-Language: en-US\r\n"
+                                    "Cookie: MC1=GUID=36e492f393964b65847bcc452818c5a5&HASH=36e4&LV=202404&V=4&LU=1713276371377; platformid_asm=41; skypetoken_asm=eyJhbGciOiJSUzI1NiIsImtpZCI6IjExRkNCRjhEQzBFRTMzQUY3QkIwQTE3OUUzNjI0RUNBNjk1ODE2NjQiLCJ4NXQiOiJFZnlfamNEdU02OTdzS0Y1NDJKT3ltbFlGbVEiLCJ0eXAiOiJKV1QifQ.eyJpYXQiOjE3MzEyNzkzOTYsImV4cCI6MTczMTI4NzE2OCwic2t5cGVpZCI6Im9yZ2lkOmM3MmQ2MTQ2LWI3OWQtNDg5MC05NmFkLWQzYWI3MDRhM2VhZCIsInNjcCI6NzgwLCJjc2kiOiIxNzMxMjc5MDk2IiwidGlkIjoiMmMzNmM0NzgtM2QwMC00NTJmLTg1MzUtNDgzOTZmNWYwMWYwIiwicmduIjoiYW1lciIsImFhZF91dGkiOiJFOE9CS3R4R3ZVT2VpMHppaTFFR0FBIiwiYWFkX2lhdCI6MTczMTI3OTA5NiwiYWFkX2FwcGlkIjoiNWUzY2U2YzAtMmIxZi00Mjg1LThkNGItNzVlZTc4Nzg3MzQ2IiwiYWFkX3BmdCI6IjJxMVp5VkxKU01sVFNVWElDMHVrR1ZhRk9Gb2JCSm1HZXFhYUdYcW5obnJuQmlWVlZSb2xtVVFXaC1iby1rYzdoeFZWbWtSVWh4ZWxBSGM1UW5TNUEyamdnMGR2RU5hM1N5Uy13MU5pNUpDdXlPTkU0TWpjajBOVFZBS2pDbFlDS1dnQXxmVkpkVDlzd0ZQMHJLS19VeFZfeFI2UkpTd3NGMWhZb29XVXdUU2lPSFVocG14SW5wWFRhZjk5TmhDYnRaWG54OGZFNTV6clg5MWN3Q0tJZ0pVRXZHQUlvdkNjbk5HTWk0MUloWmpGR1BLUTVVaUVMRVZkTWl6ek1NY254Q1JqT2dnajNnbEVRRWNrSWxScHIwUXZPUDdkS0VxRjZ3YWJUWEVKMFctSUMxamlaeGZSRVBjVHcxYk8zNmU2d3hNY1haR3VrZnp6ZURldXAyNzN6dVQ4X1pNM2stdnF5VElZMGUwbnhGN0NQZy1nSDVQenNCWk11OWdyaU1QQmxWeE1yTGdVRGVndjA4Qkg0SllDa0xreTZnczFyVzN2bFBFQVBzUEd1QW1nQjBoVFRTS3BVUmdwakhHa1NSUlNPWnAtR283OFI5OEJra2xwQnVFQkdhZ3N0MFJocGtWcGtXV29rNWlsenFRV3BhMHNqZ2tKRUNTSmFZSTZWRmdDWllreUJUUUViU3EwNVZ3cHhyYVNVR256cnRsTVlNd28zaVVfMVVOQ3pFT2kwcGZ0eDhocTc2WXhPNGxoUDhQM29hdjRjR3FJR2FwVHJVYmIzazRFZHZGMS1uSHE3cUJMSnRfSDBiQnZIZmZEZnR2X1MxQzlsVlJ6U3VpZzNfVnU0NTMxVjFPN28xajNfUzdTdGVTcldXMWY1Y3RPcElhR0JoRnpueG1KQmtlRXVRNXdZZzR5V0JpbXNRNjJJekpYaklGMkFkTjJjai1oNFUzekxjczBYaE16RjZHTmNIVzcyVHgtenhkM0tIcEpsYy1QdHczSThCOGNPSFBNRXdQZnVYUl9ha2ZSZDE3X21aVlVYRzFlanh2ZXpjZzJhMVg5UEg3c0UwX1dyblkyN2RtYmdyWEtUYzR1WXl6WGlRbW1rQ0dkSUNrTTBkeW9Nc1c3SGFyXzJUNFd0WEZ1Q0hCRWVfUDREfEg1RGFqcllIbTZTSm5XX3ZYdW54UTNuQVJmaWVTbnQ5ZDhuQkJQdUlCb2FYVmFBUkRrNmo1RC1jaTJhRXVzZUpoUWlZNEtWcS1EdmZoZDh1VEl0Z2tzZEMzdE12a3h5eVo1VGNKaXV3MWtXeElQdVFFZGZVSFU3TlJZaHZycUxncTVjbFh6ajRROVYyVEh1bWJpNVRxQnFoc21MWW1CZ3I0dkVMb3Y1ZlVWUjRLNU53VmNWRG9KM2ltWWRRU3FjRWU1aXRaSUJfaW5QdHpJbXJ4LWhYZEdldlBSZlVDS21uQUhYMUF4aGZFLU0tT0gxb3h0bHA0T3J0YkVueGxORjNXdlRwTF9xMmZRZmNkcjhOZmpUZ3BianhEVHd1NEZKY0VENWVDQVZwVmhTYVRqaU9oM1BleW9nb1Rfd2ZhbGlWOWhYTzhjUEJJRmxkQlM0S1cxZHowdyIsImFjY3QiOjB9.HT74XD49JJWCJDln9NaEfI5LJ8khL4kQUSUJHxTFX9KdNvkHE25CmHqicVR38mIrLI7EygNF2Me13ajtSuekHV6RfrFuBKdrMypdt7z2INMsYzTdH1eN5Cq622fOb13zb4z5taQGftRzVKn3q3yJUZtaEX9us_pFvBUSvN25eJ6Q2jxQyCeBxqw0wOUKe6yoLWPTNi5N-_WG6hyNFXZLP9rJVOtd9YTDUWIjGPUC_mmGQXga0tUfI2YcfA8ARe-uiGt8RCi_gB3YSikfKwk2VUwNzfAmGC1NjiVEDtpuKguHVSCRnirsgcIRWNBL2mSA6kpdLS_atYmslvRX0t13Zg\r\n"
+                                    "Sec-WebSocket-Key: 7RvtPgk Klxsq8mCOOTpKg==\r\n"
+                                    "Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits";
+
 } const HTTP_SAMPLES;
 
 using namespace sx::engine::http;
@@ -119,6 +134,12 @@ auto test = [] {
     std::cout << "h3     : " << HTTP_SAMPLES.JA4H_3 << "\n";
     std::cout << "h3 r my: " << h3.ja4h_raw() << "\n";
     std::cout << "h3 r   : " << HTTP_SAMPLES.JA4H_r_3 << "\n";
+
+    HTTP h4;
+    h4.version = "11";
+    h4.from_buffer(HTTP_SAMPLES.cookie1);
+    std::cout << "h4 my: " << h4.ja4h() << "\n";
+
 };
 
 TEST(HTTP1, trivial) {