Cybersecurity-Projects/PROJECTS/intermediate/ja3-ja4-tls-fingerprinting/install.sh

96 lines
2.8 KiB
Bash
Executable File

#!/usr/bin/env bash
# ©AngelaMos | 2026
# install.sh
set -euo pipefail
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
RED='\033[0;31m'
CYAN='\033[0;36m'
NC='\033[0m'
info() { printf "${CYAN}==>${NC} %s\n" "$1"; }
ok() { printf "${GREEN}OK${NC} %s\n" "$1"; }
warn() { printf "${YELLOW}WARN${NC} %s\n" "$1"; }
fail() { printf "${RED}ERROR${NC} %s\n" "$1" >&2; exit 1; }
JA4DB_URL="${JA4DB_URL:-https://ja4db.com/api/read/}"
JA4DB_TIMEOUT="${JA4DB_TIMEOUT:-180}"
SETCAP=0
for arg in "$@"; do
case "$arg" in
--live) SETCAP=1 ;;
-h|--help)
cat <<'EOF'
Usage: ./install.sh [--live]
Builds the release binary, seeds the bundled intelligence feeds, and pulls the
ja4db.com enrichment feed. Pass --live to also grant the capabilities live
capture needs (this step uses sudo).
EOF
exit 0
;;
*) fail "unknown argument: $arg (try --help)" ;;
esac
done
cd "$(dirname "$0")"
command -v cargo >/dev/null 2>&1 || fail "cargo not found; install Rust from https://rustup.rs"
info "Building the release binary"
cargo build --release
BIN="$PWD/target/release/tlsfp"
[ -x "$BIN" ] || fail "build succeeded but $BIN is missing"
ok "built $BIN"
info "Seeding the bundled feeds (abuse.ch SSLBL, salesforce/ja3, curated C2)"
"$BIN" intel seed
ok "bundled feeds loaded"
info "Fetching the ja4db.com enrichment feed"
if ! command -v curl >/dev/null 2>&1; then
warn "curl not found; skipping ja4db. The bundled feeds still work."
else
TMP="$(mktemp)"
trap 'rm -f "$TMP"' EXIT
if curl -fsSL --max-time "$JA4DB_TIMEOUT" "$JA4DB_URL" -o "$TMP"; then
"$BIN" intel import "$TMP"
ok "ja4db imported"
else
warn "could not reach $JA4DB_URL (it is large and often slow)."
warn "the bundled feeds still work; retry later with:"
printf " %s intel import <(curl -fsSL %s)\n" "$BIN" "$JA4DB_URL"
fi
fi
if [ "$SETCAP" -eq 1 ]; then
info "Granting live capture capabilities (needs sudo)"
if command -v setcap >/dev/null 2>&1; then
if sudo setcap cap_net_raw,cap_net_admin=eip "$BIN"; then
ok "live capture enabled for $BIN"
else
warn "setcap failed; run live capture under sudo, or grant it later with:"
printf " sudo setcap cap_net_raw,cap_net_admin=eip %s\n" "$BIN"
fi
else
warn "setcap not found (install libcap2-bin); run live capture under sudo instead"
fi
fi
printf "\n"
ok "Done. The binary is at $BIN"
cat <<EOF
Next steps:
$BIN intel stats show what the database holds
$BIN intel lookup ja3 <hash> look one fingerprint up
$BIN pcap --intel <file.pcap> fingerprint a capture and flag known intel
$BIN live --intel <iface> the same, live (needs --live above or sudo)
To put tlsfp on your PATH:
cargo install --path crates/tlsfp
EOF