96 lines
2.8 KiB
Bash
Executable File
96 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# install.sh
|
|
|
|
set -euo pipefail
|
|
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
RED='\033[0;31m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
info() { printf "${CYAN}==>${NC} %s\n" "$1"; }
|
|
ok() { printf "${GREEN}OK${NC} %s\n" "$1"; }
|
|
warn() { printf "${YELLOW}WARN${NC} %s\n" "$1"; }
|
|
fail() { printf "${RED}ERROR${NC} %s\n" "$1" >&2; exit 1; }
|
|
|
|
JA4DB_URL="${JA4DB_URL:-https://ja4db.com/api/read/}"
|
|
JA4DB_TIMEOUT="${JA4DB_TIMEOUT:-180}"
|
|
|
|
SETCAP=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--live) SETCAP=1 ;;
|
|
-h|--help)
|
|
cat <<'EOF'
|
|
Usage: ./install.sh [--live]
|
|
|
|
Builds the release binary, seeds the bundled intelligence feeds, and pulls the
|
|
ja4db.com enrichment feed. Pass --live to also grant the capabilities live
|
|
capture needs (this step uses sudo).
|
|
EOF
|
|
exit 0
|
|
;;
|
|
*) fail "unknown argument: $arg (try --help)" ;;
|
|
esac
|
|
done
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
command -v cargo >/dev/null 2>&1 || fail "cargo not found; install Rust from https://rustup.rs"
|
|
|
|
info "Building the release binary"
|
|
cargo build --release
|
|
BIN="$PWD/target/release/tlsfp"
|
|
[ -x "$BIN" ] || fail "build succeeded but $BIN is missing"
|
|
ok "built $BIN"
|
|
|
|
info "Seeding the bundled feeds (abuse.ch SSLBL, salesforce/ja3, curated C2)"
|
|
"$BIN" intel seed
|
|
ok "bundled feeds loaded"
|
|
|
|
info "Fetching the ja4db.com enrichment feed"
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
warn "curl not found; skipping ja4db. The bundled feeds still work."
|
|
else
|
|
TMP="$(mktemp)"
|
|
trap 'rm -f "$TMP"' EXIT
|
|
if curl -fsSL --max-time "$JA4DB_TIMEOUT" "$JA4DB_URL" -o "$TMP"; then
|
|
"$BIN" intel import "$TMP"
|
|
ok "ja4db imported"
|
|
else
|
|
warn "could not reach $JA4DB_URL (it is large and often slow)."
|
|
warn "the bundled feeds still work; retry later with:"
|
|
printf " %s intel import <(curl -fsSL %s)\n" "$BIN" "$JA4DB_URL"
|
|
fi
|
|
fi
|
|
|
|
if [ "$SETCAP" -eq 1 ]; then
|
|
info "Granting live capture capabilities (needs sudo)"
|
|
if command -v setcap >/dev/null 2>&1; then
|
|
if sudo setcap cap_net_raw,cap_net_admin=eip "$BIN"; then
|
|
ok "live capture enabled for $BIN"
|
|
else
|
|
warn "setcap failed; run live capture under sudo, or grant it later with:"
|
|
printf " sudo setcap cap_net_raw,cap_net_admin=eip %s\n" "$BIN"
|
|
fi
|
|
else
|
|
warn "setcap not found (install libcap2-bin); run live capture under sudo instead"
|
|
fi
|
|
fi
|
|
|
|
printf "\n"
|
|
ok "Done. The binary is at $BIN"
|
|
cat <<EOF
|
|
|
|
Next steps:
|
|
$BIN intel stats show what the database holds
|
|
$BIN intel lookup ja3 <hash> look one fingerprint up
|
|
$BIN pcap --intel <file.pcap> fingerprint a capture and flag known intel
|
|
$BIN live --intel <iface> the same, live (needs --live above or sudo)
|
|
|
|
To put tlsfp on your PATH:
|
|
cargo install --path crates/tlsfp
|
|
EOF
|