9.29.2

CHANGELOG.md

@@ -13,6 +13,12 @@ All major and minor version changes will be documented in this file. Details of
 
 ## Details
 
+### [9.29.0] - 2021-07-28
+- 'TLS JA3 Fingerprint' operation added [@n1474335] | [9a33498]
+
+### [9.28.0] - 2021-03-26
+- 'CBOR Encode' and 'CBOR Decode' operations added [@Danh4] | [#999]
+
 ### [9.27.0] - 2021-02-12
 - 'Fuzzy Match' operation added [@n1474335] | [8ad18b]
 
@@ -256,6 +262,8 @@ All major and minor version changes will be documented in this file. Details of
 
 
 
+[9.29.0]: https://github.com/gchq/CyberChef/releases/tag/v9.29.0
+[9.28.0]: https://github.com/gchq/CyberChef/releases/tag/v9.28.0
 [9.27.0]: https://github.com/gchq/CyberChef/releases/tag/v9.27.0
 [9.26.0]: https://github.com/gchq/CyberChef/releases/tag/v9.26.0
 [9.25.0]: https://github.com/gchq/CyberChef/releases/tag/v9.25.0
@@ -363,8 +371,10 @@ All major and minor version changes will be documented in this file. Details of
 [@MarvinJWendt]: https://github.com/MarvinJWendt
 [@dmfj]: https://github.com/dmfj
 [@mattnotmitt]: https://github.com/mattnotmitt
+[@Danh4]: https://github.com/Danh4
 
 [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7
+[9a33498]: https://github.com/gchq/CyberChef/commit/9a33498fed26a8df9c9f35f39a78a174bf50a513
 
 [#95]: https://github.com/gchq/CyberChef/pull/299
 [#173]: https://github.com/gchq/CyberChef/pull/173
@@ -438,6 +448,7 @@ All major and minor version changes will be documented in this file. Details of
 [#965]: https://github.com/gchq/CyberChef/pull/965
 [#966]: https://github.com/gchq/CyberChef/pull/966
 [#987]: https://github.com/gchq/CyberChef/pull/987
+[#999]: https://github.com/gchq/CyberChef/pull/999
 [#1006]: https://github.com/gchq/CyberChef/pull/1006
 [#1022]: https://github.com/gchq/CyberChef/pull/1022
 [#1045]: https://github.com/gchq/CyberChef/pull/1045

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "9.27.5",
+  "version": "9.29.2",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",
@@ -43,7 +43,7 @@
     "babel-eslint": "^10.1.0",
     "babel-loader": "^8.2.2",
     "babel-plugin-dynamic-import-node": "^2.3.3",
-    "chromedriver": "^88.0.0",
+    "chromedriver": "^92.0.0",
     "cli-progress": "^3.9.0",
     "colors": "^1.4.0",
     "copy-webpack-plugin": "^7.0.0",
@@ -65,7 +65,7 @@
     "html-webpack-plugin": "^5.1.0",
     "imports-loader": "^2.0.0",
     "mini-css-extract-plugin": "^1.3.7",
-    "nightwatch": "^1.5.1",
+    "nightwatch": "^1.7.7",
     "node-sass": "^5.0.0",
     "postcss": "^8.2.6",
     "postcss-css-variables": "^0.17.0",
@@ -80,7 +80,7 @@
     "webpack": "^5.22.0",
     "webpack-bundle-analyzer": "^4.4.0",
     "webpack-dev-server": "^3.11.2",
-    "webpack-node-externals": "^2.5.2",
+    "webpack-node-externals": "^3.0.0",
     "worker-loader": "^3.0.8"
   },
   "dependencies": {
@@ -98,6 +98,7 @@
     "browserify-zlib": "^0.2.0",
     "bson": "^4.2.2",
     "buffer": "^6.0.3",
+    "cbor": "^5.0.1",
     "chi-squared": "^1.1.0",
     "codepage": "^1.14.0",
     "core-js": "^3.8.3",
@@ -122,14 +123,14 @@
     "js-crc": "^0.2.0",
     "js-sha3": "^0.8.0",
     "jsesc": "^3.0.2",
-    "jsonpath": "^1.1.0",
+    "jsonpath": "^1.1.1",
     "jsonwebtoken": "^8.5.1",
     "jsqr": "^1.3.1",
-    "jsrsasign": "^10.1.10",
+    "jsrsasign": "^10.3.0",
     "kbpgp": "2.1.15",
     "libbzip2-wasm": "0.0.4",
     "libyara-wasm": "^1.1.0",
-    "lodash": "^4.17.20",
+    "lodash": "^4.17.21",
     "loglevel": "^1.7.1",
     "loglevel-message-prefix": "^3.0.0",
     "markdown-it": "^12.0.4",
@@ -158,7 +159,7 @@
     "unorm": "^1.6.0",
     "utf8": "^3.0.0",
     "vkbeautify": "^0.99.3",
-    "xmldom": "^0.4.0",
+    "xmldom": "^0.6.0",
     "xpath": "0.0.32",
     "xregexp": "^5.0.1",
     "zlibjs": "^0.3.1"

src/core/config/Categories.json

@@ -61,7 +61,9 @@
             "Parse TLV",
             "CSV to JSON",
             "JSON to CSV",
-            "Avro to JSON"
+            "Avro to JSON",
+            "CBOR Encode",
+            "CBOR Decode"
         ]
     },
     {
@@ -191,6 +193,7 @@
             "Protobuf Decode",
             "VarInt Encode",
             "VarInt Decode",
+            "TLS JA3 Fingerprint",
             "Format MAC addresses",
             "Change IP format",
             "Group IP addresses",

src/core/operations/CBORDecode.mjs

@@ -0,0 +1,41 @@
+/**
+ * @author Danh4 [dan.h4@ncsc.gov.uk]
+ * @copyright Crown Copyright 2020
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Cbor from "cbor";
+
+/**
+ * CBOR Decode operation
+ */
+class CBORDecode extends Operation {
+
+    /**
+     * CBORDecode constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "CBOR Decode";
+        this.module = "Serialise";
+        this.description = "Concise Binary Object Representation (CBOR) is a binary data serialization format loosely based on JSON. Like JSON it allows the transmission of data objects that contain name–value pairs, but in a more concise manner. This increases processing and transfer speeds at the cost of human readability. It is defined in IETF RFC 8949.";
+        this.infoURL = "https://wikipedia.org/wiki/CBOR";
+        this.inputType = "ArrayBuffer";
+        this.outputType = "JSON";
+        this.args = [];
+    }
+
+    /**
+     * @param {ArrayBuffer} input
+     * @param {Object[]} args
+     * @returns {JSON}
+     */
+    run(input, args) {
+        return Cbor.decodeFirstSync(Buffer.from(input).toString("hex"));
+    }
+
+}
+
+export default CBORDecode;

src/core/operations/CBOREncode.mjs

@@ -0,0 +1,41 @@
+/**
+ * @author Danh4 [dan.h4@ncsc.gov.uk]
+ * @copyright Crown Copyright 2020
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Cbor from "cbor";
+
+/**
+ * CBOR Encode operation
+ */
+class CBOREncode extends Operation {
+
+    /**
+     * CBOREncode constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "CBOR Encode";
+        this.module = "Serialise";
+        this.description = "Concise Binary Object Representation (CBOR) is a binary data serialization format loosely based on JSON. Like JSON it allows the transmission of data objects that contain name–value pairs, but in a more concise manner. This increases processing and transfer speeds at the cost of human readability. It is defined in IETF RFC 8949.";
+        this.infoURL = "https://wikipedia.org/wiki/CBOR";
+        this.inputType = "JSON";
+        this.outputType = "ArrayBuffer";
+        this.args = [];
+    }
+
+    /**
+     * @param {JSON} input
+     * @param {Object[]} args
+     * @returns {ArrayBuffer}
+     */
+    run(input, args) {
+        return new Uint8Array(Cbor.encodeCanonical(input)).buffer;
+    }
+
+}
+
+export default CBOREncode;

src/core/operations/ParseIPv6Address.mjs

@@ -165,6 +165,89 @@ class ParseIPv6Address extends Operation {
                 // Multicast
                 output += "\nThis is a reserved multicast address.";
                 output += "\nMulticast addresses range: ff00::/8";
+
+                switch (ipv6[0]) {
+                    case 0xff01:
+                        output += "\n\nReserved Multicast Block for Interface Local Scope";
+                        break;
+                    case 0xff02:
+                        output += "\n\nReserved Multicast Block for Link Local Scope";
+                        break;
+                    case 0xff03:
+                        output += "\n\nReserved Multicast Block for Realm Local Scope";
+                        break;
+                    case 0xff04:
+                        output += "\n\nReserved Multicast Block for Admin Local Scope";
+                        break;
+                    case 0xff05:
+                        output += "\n\nReserved Multicast Block for Site Local Scope";
+                        break;
+                    case 0xff08:
+                        output += "\n\nReserved Multicast Block for Organisation Local Scope";
+                        break;
+                    case 0xff0e:
+                        output += "\n\nReserved Multicast Block for Global Scope";
+                        break;
+                }
+
+                if (ipv6[6] === 1) {
+                    if (ipv6[7] === 2) {
+                        output += "\nReserved Multicast Address for 'All DHCP Servers and Relay Agents (defined in RFC3315)'";
+                    } else if (ipv6[7] === 3) {
+                        output += "\nReserved Multicast Address for 'All LLMNR Hosts (defined in RFC4795)'";
+                    }
+                } else {
+                    switch (ipv6[7]) {
+                        case 1:
+                            output += "\nReserved Multicast Address for 'All nodes'";
+                            break;
+                        case 2:
+                            output += "\nReserved Multicast Address for 'All routers'";
+                            break;
+                        case 5:
+                            output += "\nReserved Multicast Address for 'OSPFv3 - All OSPF routers'";
+                            break;
+                        case 6:
+                            output += "\nReserved Multicast Address for 'OSPFv3 - All Designated Routers'";
+                            break;
+                        case 8:
+                            output += "\nReserved Multicast Address for 'IS-IS for IPv6 Routers'";
+                            break;
+                        case 9:
+                            output += "\nReserved Multicast Address for 'RIP Routers'";
+                            break;
+                        case 0xa:
+                            output += "\nReserved Multicast Address for 'EIGRP Routers'";
+                            break;
+                        case 0xc:
+                            output += "\nReserved Multicast Address for 'Simple Service Discovery Protocol'";
+                            break;
+                        case 0xd:
+                            output += "\nReserved Multicast Address for 'PIM Routers'";
+                            break;
+                        case 0x16:
+                            output += "\nReserved Multicast Address for 'MLDv2 Reports (defined in RFC3810)'";
+                            break;
+                        case 0x6b:
+                            output += "\nReserved Multicast Address for 'Precision Time Protocol v2 Peer Delay Measurement Messages'";
+                            break;
+                        case 0xfb:
+                            output += "\nReserved Multicast Address for 'Multicast DNS'";
+                            break;
+                        case 0x101:
+                            output += "\nReserved Multicast Address for 'Network Time Protocol'";
+                            break;
+                        case 0x108:
+                            output += "\nReserved Multicast Address for 'Network Information Service'";
+                            break;
+                        case 0x114:
+                            output += "\nReserved Multicast Address for 'Experiments'";
+                            break;
+                        case 0x181:
+                            output += "\nReserved Multicast Address for 'Precision Time Protocol v2 Messages (exc. Peer Delay)'";
+                            break;
+                    }
+                }
             }
 
 

src/core/operations/TLSJA3Fingerprint.mjs

@@ -0,0 +1,198 @@
+/**
+ * @author n1474335 [n1474335@gmail.com]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import Utils from "../Utils.mjs";
+import Stream from "../lib/Stream.mjs";
+import {runHash} from "../lib/Hash.mjs";
+
+/**
+ * TLS JA3 Fingerprint operation
+ */
+class TLSJA3Fingerprint extends Operation {
+
+    /**
+     * TLSJA3Fingerprint constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "TLS JA3 Fingerprint";
+        this.module = "Crypto";
+        this.description = "Generates a JA3 fingerprint to help identify TLS clients based on hashing together values from the Client Hello.<br><br>Input: A hex stream of the TLS Client Hello application layer.";
+        this.infoURL = "https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Input format",
+                type: "option",
+                value: ["Hex", "Base64", "Raw"]
+            },
+            {
+                name: "Output format",
+                type: "option",
+                value: ["Hash digest", "JA3 string", "Full details"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [inputFormat, outputFormat] = args;
+
+        input = Utils.convertToByteArray(input, inputFormat);
+        const s = new Stream(new Uint8Array(input));
+
+        const handshake = s.readInt(1);
+        if (handshake !== 0x16)
+            throw new OperationError("Not handshake data.");
+
+        // Version
+        s.moveForwardsBy(2);
+
+        // Length
+        const length = s.readInt(2);
+        if (s.length !== length + 5)
+            throw new OperationError("Incorrect handshake length.");
+
+        // Handshake type
+        const handshakeType = s.readInt(1);
+        if (handshakeType !== 1)
+            throw new OperationError("Not a Client Hello.");
+
+        // Handshake length
+        const handshakeLength = s.readInt(3);
+        if (s.length !== handshakeLength + 9)
+            throw new OperationError("Not enough data in Client Hello.");
+
+        // Hello version
+        const helloVersion = s.readInt(2);
+
+        // Random
+        s.moveForwardsBy(32);
+
+        // Session ID
+        const sessionIDLength = s.readInt(1);
+        s.moveForwardsBy(sessionIDLength);
+
+        // Cipher suites
+        const cipherSuitesLength = s.readInt(2);
+        const cipherSuites = s.getBytes(cipherSuitesLength);
+        const cs = new Stream(cipherSuites);
+        const cipherSegment = parseJA3Segment(cs, 2);
+
+        // Compression Methods
+        const compressionMethodsLength = s.readInt(1);
+        s.moveForwardsBy(compressionMethodsLength);
+
+        // Extensions
+        const extensionsLength = s.readInt(2);
+        const extensions = s.getBytes(extensionsLength);
+        const es = new Stream(extensions);
+        let ecsLen, ecs, ellipticCurves = "", ellipticCurvePointFormats = "";
+        const exts = [];
+        while (es.hasMore()) {
+            const type = es.readInt(2);
+            const length = es.readInt(2);
+            switch (type) {
+                case 0x0a: // Elliptic curves
+                    ecsLen = es.readInt(2);
+                    ecs = new Stream(es.getBytes(ecsLen));
+                    ellipticCurves = parseJA3Segment(ecs, 2);
+                    break;
+                case 0x0b: // Elliptic curve point formats
+                    ecsLen = es.readInt(1);
+                    ecs = new Stream(es.getBytes(ecsLen));
+                    ellipticCurvePointFormats = parseJA3Segment(ecs, 1);
+                    break;
+                default:
+                    es.moveForwardsBy(length);
+            }
+            if (!GREASE_CIPHERSUITES.includes(type))
+                exts.push(type);
+        }
+
+        // Output
+        const ja3 = [
+            helloVersion.toString(),
+            cipherSegment,
+            exts.join("-"),
+            ellipticCurves,
+            ellipticCurvePointFormats
+        ];
+        const ja3Str = ja3.join(",");
+        const ja3Hash = runHash("md5", Utils.strToArrayBuffer(ja3Str));
+
+        switch (outputFormat) {
+            case "JA3 string":
+                return ja3Str;
+            case "Full details":
+                return `Hash digest:
+${ja3Hash}
+
+Full JA3 string:
+${ja3Str}
+
+TLS Version:
+${helloVersion.toString()}
+Cipher Suites:
+${cipherSegment}
+Extensions:
+${exts.join("-")}
+Elliptic Curves:
+${ellipticCurves}
+Elliptic Curve Point Formats:
+${ellipticCurvePointFormats}`;
+            case "Hash digest":
+            default:
+                return ja3Hash;
+        }
+    }
+
+}
+
+/**
+ * Parses a JA3 segment, returning a "-" separated list
+ *
+ * @param {Stream} stream
+ * @returns {string}
+ */
+function parseJA3Segment(stream, size=2) {
+    const segment = [];
+    while (stream.hasMore()) {
+        const element = stream.readInt(size);
+        if (!GREASE_CIPHERSUITES.includes(element))
+            segment.push(element);
+    }
+    return segment.join("-");
+}
+
+const GREASE_CIPHERSUITES = [
+    0x0a0a,
+    0x1a1a,
+    0x2a2a,
+    0x3a3a,
+    0x4a4a,
+    0x5a5a,
+    0x6a6a,
+    0x7a7a,
+    0x8a8a,
+    0x9a9a,
+    0xaaaa,
+    0xbaba,
+    0xcaca,
+    0xdada,
+    0xeaea,
+    0xfafa
+];
+
+export default TLSJA3Fingerprint;

src/web/html/index.html

@@ -686,7 +686,7 @@
                                 <div class="collapse" id="faq-load-files">
                                     <p>Yes! Just drag your file over the input box and drop it.</p>
                                     <p>CyberChef can handle files up to around 2GB (depending on your browser), however some of the operations may take a very long time to run over this much data.</p>
-                                    <p>If the output is larger than a certain threshold (default 1MiB), it will be presented to you as a file available for download. Slices of the file can be viewed in the output if you need to inspect them.</p>
+                                    <p>If the output is larger than a certain threshold (default <a href="#recipe=Multiply('Line%20feed')Convert_data_units('Bytes%20(B)','Mebibytes%20(MiB)')&input=MTAyNAoxMDI0">1MiB</a>), it will be presented to you as a file available for download. Slices of the file can be viewed in the output if you need to inspect them.</p>
                                 </div>
                                 <br>
 

tests/operations/index.mjs

@@ -102,6 +102,10 @@ import "./tests/Colossus.mjs";
 import "./tests/ParseObjectIDTimestamp.mjs";
 import "./tests/Unicode.mjs";
 import "./tests/RSA.mjs";
+import "./tests/CBOREncode.mjs";
+import "./tests/CBORDecode.mjs";
+import "./tests/TLSJA3Fingerprint.mjs";
+
 
 // Cannot test operations that use the File type yet
 // import "./tests/SplitColourChannels.mjs";

tests/operations/tests/CBORDecode.mjs

@@ -0,0 +1,144 @@
+/**
+ * CBOR Decode Tests
+ *
+ * @author Danh4 [dan.h4@ncsc.gov.uk]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "CBOR Decode: Can decode integer",
+        input: "0f",
+        expectedOutput: "15",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Decode: Can decode decimal",
+        input: "f9 3e 00",
+        expectedOutput: "1.5",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can decode text",
+        input: "64 54 65 78 74",
+        expectedOutput: "\"Text\"",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can decode boolean true",
+        input: "f5",
+        expectedOutput: "true",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can decode boolean false",
+        input: "f4",
+        expectedOutput: "false",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can decode map",
+        input: "a3 61 61 01 61 62 02 61 63 03",
+        expectedOutput: JSON.stringify({a: 1, b: 2, c: 3}),
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            },
+            {
+                op: "JSON Minify",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can decode list",
+        input: "83 00 01 02",
+        expectedOutput: "[0,1,2]",
+        recipeConfig: [
+            {
+                op: "From Hex",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            },
+            {
+                op: "JSON Minify",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "From Hex: Can round trip with encode",
+        input: JSON.stringify({a: 1, b: false, c: [1, 2, 3]}),
+        expectedOutput: JSON.stringify({a: 1, b: false, c: [1, 2, 3]}),
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "CBOR Decode",
+                args: []
+            },
+            {
+                op: "JSON Minify",
+                args: []
+            }
+        ]
+    }
+]);

tests/operations/tests/CBOREncode.mjs

@@ -0,0 +1,117 @@
+/**
+ * CBOR Encode Tests.
+ *
+ * @author Danh4 [dan.h4@ncsc.gov.uk]
+ * @copyright Crown Copyright 2019
+ * @license Apache-2.0
+ */
+
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "CBOR Encode: Can encode integer",
+        input: "15",
+        expectedOutput: "0f",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Decode: Can encode decimal",
+        input: "1.5",
+        expectedOutput: "f9 3e 00",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Encode: Can encode text",
+        input: "\"Text\"",
+        expectedOutput: "64 54 65 78 74",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Encode: Can encode boolean true",
+        input: "true",
+        expectedOutput: "f5",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Encode: Can encode boolean false",
+        input: "false",
+        expectedOutput: "f4",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Encode: Can encode map",
+        input: JSON.stringify({a: 1, b: 2, c: 3}),
+        expectedOutput: "a3 61 61 01 61 62 02 61 63 03",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    },
+    {
+        name: "CBOR Encode: Can encode list",
+        input: "[0,1,2]",
+        expectedOutput: "83 00 01 02",
+        recipeConfig: [
+            {
+                op: "CBOR Encode",
+                args: []
+            },
+            {
+                op: "To Hex",
+                args: []
+            }
+        ]
+    }
+]);

tests/operations/tests/TLSJA3Fingerprint.mjs

@@ -0,0 +1,55 @@
+/**
+ * TLSJA3Fingerprint tests.
+ *
+ * @author n1474335 [n1474335@gmail.com]
+ * @copyright Crown Copyright 2021
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "TLS JA3 Fingerprint: TLS 1.0",
+        input: "16030100a4010000a00301543dd2dd48f517ca9a93b1e599f019fdece704a23e86c1dcac588427abbaddf200005cc014c00a0039003800880087c00fc00500350084c012c00800160013c00dc003000ac013c00900330032009a009900450044c00ec004002f009600410007c011c007c00cc002000500040015001200090014001100080006000300ff0100001b000b000403000102000a000600040018001700230000000f000101",
+        expectedOutput: "503053a0c5b2bd9b9334bf7f3d3b8852",
+        recipeConfig: [
+            {
+                "op": "TLS JA3 Fingerprint",
+                "args": ["Hex", "Hash digest"]
+            }
+        ],
+    },
+    {
+        name: "TLS JA3 Fingerprint: TLS 1.1",
+        input: "16030100a4010000a00302543dd2ed907e47d0086f34bee2c52dd6ccd8de63ba9387f5e810b09d9d49b38000005cc014c00a0039003800880087c00fc00500350084c012c00800160013c00dc003000ac013c00900330032009a009900450044c00ec004002f009600410007c011c007c00cc002000500040015001200090014001100080006000300ff0100001b000b000403000102000a000600040018001700230000000f000101",
+        expectedOutput: "a314eb64cee6cb832aaaa372c8295bab",
+        recipeConfig: [
+            {
+                "op": "TLS JA3 Fingerprint",
+                "args": ["Hex", "Hash digest"]
+            }
+        ],
+    },
+    {
+        name: "TLS JA3 Fingerprint: TLS 1.2",
+        input: "1603010102010000fe0303543dd3283283692d85f9416b5ccc65d2aafca45c6530b3c6eafbf6d371b6a015000094c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc027c023c013c00900a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f009600410007c011c007c00cc002000500040015001200090014001100080006000300ff01000041000b000403000102000a000600040018001700230000000d002200200601060206030501050205030401040204030301030203030201020202030101000f000101",
+        expectedOutput: "c1a36e1a870786cc75edddc0009eaf3a",
+        recipeConfig: [
+            {
+                "op": "TLS JA3 Fingerprint",
+                "args": ["Hex", "Hash digest"]
+            }
+        ],
+    },
+    {
+        name: "TLS JA3 Fingerprint: TLS 1.3",
+        input: "1603010200010001fc03034355d402c132771a9386b6e9994ae37069e0621af504c26673b1343843c21d8d0000264a4a130113021303c02bc02fc02cc030cca9cca8cc14cc13c013c014009c009d002f0035000a010001addada0000ff01000100000000180016000013626c6f672e636c6f7564666c6172652e636f6d0017000000230000000d00140012040308040401050308050501080606010201000500050100000000001200000010000e000c02683208687474702f312e3175500000000b000201000028002b00295a5a000100001d0020cf78b9167af054b922a96752b43973107b2a57766357dd288b2b42ab5df30e08002d00020101002b000b0acaca7f12030303020301000a000a00085a5a001d001700180a0a000100001500e4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+        expectedOutput: "4826a90ec2daf4f7b4b64cc1c8bd343b",
+        recipeConfig: [
+            {
+                "op": "TLS JA3 Fingerprint",
+                "args": ["Hex", "Hash digest"]
+            }
+        ],
+    },
+]);