Passive Fingerprinting of HTTP/2 Clients

on YouTube ↗48m

" summary

Analysis of 10 million HTTP/2 connections and 40,000+ unique user agents from Akamai logs produces fingerprints built from the exact settings frame parameters, the initial WINDOW_UPDATE value, priority-tree packets and the order of pseudo-headers. Server debug logs and Chrome net-internals provide the ground truth. Fingerprints distinguish real browsers, libraries and shared gateways, detect impersonation and proxies, but entropy plateaus so combining TCP/TLS/application signals is necessary. Attack surface stays low partly because common attack tools still lack HTTP/2 support.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 11:27Frame Types
3. 14:10Single TCP Connection
4. 18:11HTTP/2 Conversation
5. 23:57SETTINGS PARAMETERS Scope

" related talks

• 38mPassive Fingerprinting of HTTP/2 ClientsElad Shuster · AppSec USA 2017
• 43mPassive Fingerprinting of HTTP/2 Clients.Ory Segal · CODE BLUE 2017
• 44mPassive Fingerprinting of HTTP/2 ClientsElad Shuster · OWASP AppSec Europe 2018
• 49mSecurity and Insecurity of HTTP HeadersDirk Wetter · OWASP AppSec Research (AppSecEU) 2015
• 01h 00mHTTP/2 : What you need to knowRobert Boedigheimer · NDC Sydney 2016
• 01h 00mHTTP/2 - The future of the web todayRob Crowley · NDC Sydney 2017
• 19mHTTP/2 is here, now let's make it easyRebecca Murphey · dotJS 2015
• 01h 27mHTTP/2 for the Web developerBrian Clozel · SpringOne2GX 2015