Individual skill
tls-fingerprint-impersonation
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
recon/tls-fingerprint-impersonation/SKILL.md
Source commit 1260244136edc6ae698d76d3d526f503e322778d
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,346
- Repository last updated
- Nov 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- bug-bounty Repository topic
- cloud-security Repository topic
- firebase-hacking Repository topic
- hermes-agent Repository topic
- jwt-attacks Repository topic
- offensive-security Repository topic
- penetration-testing Repository topic
- reconnaissance Repository topic
- red-team Repository topic
- security-automation Repository topic
- recon Declared skill tag
- tls Declared skill tag
- ja3 Declared skill tag
- ja4 Declared skill tag
- fingerprint Declared skill tag
- impersonation Declared skill tag
- http Declared skill tag
- browser Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# TLS Fingerprint Impersonation
Spoof TLS ClientHello parameters — cipher suites, key exchange groups, signature algorithms, and extension order — to match real browsers at the JA3/JA4 fingerprint level. Uses patched rustls to rebuild the TLS layer with browser-identical configurations. Bypasses TLS fingerprinting detection (Cloudflare, Akamai, F5) that flags non-browser TLS stacks. Supports 20 browser profiles including Chrome 100-142, Firefox 128-144, Safari iOS 18, and OkHttp 3-5 (Android).
## When to Use
- Target returns 403/blocked on curl/httpx even with correct User-Agent headers.
- Cloudflare or Akamai is fingerprinting TLS ClientHello (JA3/JA4 mismatch with browser).
- API probing requires mobile-app impersonation (OkHttp fingerprint for Android).
- Need high-throughput HTTP requests that pass TLS fingerprint checks without running a full browser.
- Target shows different behavior based on TLS fingerprint (mobile vs desktop endpoints).
## Prerequisites
