Passive Fingerprinting of HTTP/2 Clients
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 11:00· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims passive client fingerprinting works by extracting deterministic patterns from the early HTTP/2 exchange and builds a compact fingerprint from settings+window_update+priority+pseudoheaders. Research uses Akamai edge logs and shows it on 10 million HTTP/2 connections covering 40,000 user agents across hundreds of implementations. The method exposes concrete distinguishing values, survives browser updates in practice, and highlights gaps (many tools like Burp suite and sqlmap lack H2 support), producing usable fingerprints for detection and validation.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:00Data Collection Methods
- 1:34The Data Collection
- 10:44The Challenges in Http 1
- 13:10The Concurrency Problem
- 13:40Server Push
- 17:29Stream Management
- 18:23Payload
- 18:42Pad Length
- 19:54Flow of the Conversation
- 21:10Exchange of Settings
- 21:57Server Logs
- 30:58Pseudo Header
- 31:25Pseudo Headers
- 35:33Key Takeaways for You
related talks
38mPassive Fingerprinting of HTTP/2 Clients
48mPassive Fingerprinting of HTTP/2 Clients
43mPassive Fingerprinting of HTTP/2 Clients.
01h 00mHTTP/2 : What you need to know
49mSecurity and Insecurity of HTTP Headers
01h 27mHTTP/2 for the Web developer
01h 00mHTTP/2 - The future of the web today
20mA quick primer on http2