Passive Fingerprinting of HTTP/2 Clients.
summary
Akamai analysts extract fingerprints from 10 million+ HTTP/2 connections and claim distinct fingerprints for 40,000 unique user agents, using Settings, Window Update, Priority frames and pseudo‑header order as stable features. Fingerprints separate Chrome/Firefox/Edge/curl/Java libs, detect user‑agent spoofing, bots and anonymous proxies, and enable positive enforcement for known mobile APIs. Practical notes: Burp lacks HTTP/2, Charles and mitmproxy can intercept, Wireshark needs TLS decryption and Chrome net‑internals shows live frames.
AI-written summary · about
chapters (23)
- 0:00Intro
- 2:00ORY SEGAL - ABOUT ME
- 7:33HTTP/2 OVERVIEW
- 8:26HTTP/1.1 CHALLENGES
- 10:34ENTER HTTP/2..
- 12:14CONCURRENCY
- 13:44HTTP/2 KEY ELEMENTS
- 14:40FRAME STRUCTURE
- 15:23HEADERS FRAME - EXAMPLE
- 17:07HTTP/2 INSPECTION TOOLS
- 18:30HTTP/2 SESSION INITIALIZATION
- 20:11KEEP IN MIND
- 22:17PASSIVE CLIENT FINGERPRINTING
- 24:05HTTP/2 FRAME TYPES USED IN FINGERPRINT
- 24:54SETTINGS FRAME The SETTINGS frame conveys configuration parameters
- 26:15SETTINGS FRAME-ENTROPY
- 26:46THE WINDOW_UPDATE FRAME
- 29:49FIREFOX PRIORITY FRAME
- 30:25SUMMARY
- 31:15PSEUDO-HEADERS
- 32:23PSEUDO-HEADER ENTROPY CONTRIBUTION
- 33:56HTTP/2 FINGERPRINT FORMAT
- 35:31PASSIVE HTTP/2 FINGERPRINTING USE CASES
related talks
48mPassive Fingerprinting of HTTP/2 Clients
38mPassive Fingerprinting of HTTP/2 Clients
44mPassive Fingerprinting of HTTP/2 Clients
49mSecurity and Insecurity of HTTP Headers
42mCracking the Code: Decoding Anti-Bot Systems!
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
44mNetsec is Dead(?): Modern Network Fingerprinting for...
24mTales From the Trenches: Fingerprints on the Web