GREASE status in MongoDB

Question

GREASE status in MongoDB

ne4u opened this issue 2 years ago · comments

I think it would be helpful to add a boolean for GREASE support in the MongoDB since it's not in the JA3 hash. GREASE is helpful in identifying bots or malicious requests spoofing user_agents.

EX: Reported user_agent is a current version of Safari on any OS. But, there is no grease support in the TLS negotiation. Therefore the conclusion is the user_agent is being faked.

Peet · Answer 1 · Thu Sep 29 2022 20:29:03 GMT+0800 (China Standard Time)

Hey, thanks for your Issue. I want to rework the logging system completely, to enable better statistics. The Idea is good, although I never encountered a client spoofing a ja3 but not sending GREASE values

ne4u · Answer 2 · Thu Sep 29 2022 23:57:33 GMT+0800 (China Standard Time)

The thought is to be able to identify spoofed user_agents. Most spoofed user_agents aren't going anything good :-)

Peet · Answer 3 · Tue Oct 11 2022 21:38:23 GMT+0800 (China Standard Time)

I am working on my own fingerprint and will have it in there

Peet · Answer 4 · Wed Oct 12 2022 05:18:57 GMT+0800 (China Standard Time)

The new fingerprint "PeetPrint" now contains grease values (actual values replaced with "GREASE")