JARM Fingerprinting

#!/usr/bin/env python3
"""
JARM scanning workflow for network forensics.
Requires: pip install jarm-scanner
Or use Salesforce's jarm.py directly.

This shows the workflow — for production use:
https://github.com/salesforce/jarm
"""
import subprocess, json, sys, time, csv
from pathlib import Path

# Known JARM fingerprints for attack frameworks
KNOWN_BAD = {
    "07d14d16d21d21d07c07d14d07d21d69e3ff64f35a08ef2a6d5bb20d6e2fc": "Cobalt Strike",
    "2ad2ad0002ad2ad22c2ad2ad2ad2adce04e5eefa49c2d15c11e3df0c0fd0": "Metasploit",
    "3fd3fd0003fd3fd21c3fd3fd3fd3fdf6c9dc4e5f8c5ad83d0fa73c10a7b0": "Sliver",
    "07d19d12d21d21d07c42d43d000000ed872eba4ffb1edbf9c3e83cdcdcfc": "Cobalt Strike (alt)",
    "29d29d00029d29d21c29d29d29d29de18ed7a8af2dba28c069f1cdde9d86": "Havoc C2",
}

def jarm_scan(ip: str, port: int = 443, timeout: int = 5) -> str:
    """Run JARM against a single target. Requires jarm.py in PATH."""
    try:
        result = subprocess.run(
            ["python3", "jarm.py", ip, str(port), "--timeout", str(timeout)],
            capture_output=True, text=True, timeout=timeout + 5
        )
        # Parse output: "Host,Port,JARM"
        for line in result.stdout.splitlines():
            if "," in line and not line.startswith("Host"):
                parts = line.split(",")
                if len(parts) >= 3:
                    return parts[2].strip()
    except Exception:
        pass
    return ""

def scan_ip_list(ip_file: str, port: int = 443, output_file: str = "jarm_results.csv"):
    """Scan a list of IPs and write results."""
    ips = []
    with open(ip_file) as f:
        for line in f:
            ip = line.strip()
            if ip and not ip.startswith("#"):
                ips.append(ip)

    print(f"Scanning {len(ips)} IPs on port {port}...")
    results = []

    with open(output_file, "w", newline="") as csvfile:
        writer = csv.writer(csvfile)
        writer.writerow(["ip", "port", "jarm", "classification"])

        for i, ip in enumerate(ips):
            jarm = jarm_scan(ip, port)
            classification = KNOWN_BAD.get(jarm, "")
            marker = " *** MATCH ***" if classification else ""

            if jarm:
                print(f"[{i+1:4d}/{len(ips)}] {ip}:{port}  {jarm[:20]}...  {classification}{marker}")
            else:
                print(f"[{i+1:4d}/{len(ips)}] {ip}:{port}  NO RESPONSE")

            writer.writerow([ip, port, jarm, classification])
            results.append({"ip": ip, "port": port, "jarm": jarm, "classification": classification})
            time.sleep(0.1)  # Rate limiting

    # Summary
    hits = [r for r in results if r["classification"]]
    print(f"\n=== JARM Scan Summary ===")
    print(f"Total scanned: {len(results)}")
    print(f"No response: {sum(1 for r in results if not r['jarm'])}")
    print(f"Known C2 matches: {len(hits)}")
    for h in hits:
        print(f"  {h['ip']}:{h['port']}  {h['jarm']}  → {h['classification']}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 jarm-scan.py  [port]")
        sys.exit(1)
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    scan_ip_list(sys.argv[1], port)