JA4+ Tutorials & Labs

Hands-on labs covering every fingerprint in the JA4+ suite. Start with Quick Labs for fundamentals, then move to Advanced Labs for real-world threat detection.

Quick Labs

View all
15 minBeginner
JA4 - TLS Client Fingerprinting
Learn the fundamentals of JA4 TLS client fingerprinting, the successor to JA3.
15 minBeginner
JA4S - TLS Server Fingerprinting
Fingerprint TLS server responses to identify server applications and configurations.
20 minBeginner
JA4H - HTTP Client Fingerprinting
Fingerprint HTTP clients by analyzing header fields and ordering.
20 minIntermediate
JA4T - TCP Client Fingerprinting
Analyze TCP window size, options, and MSS to fingerprint operating systems.
15 minIntermediate
JA4TS - TCP Server Fingerprinting
Fingerprint server-side TCP SYN-ACK responses for OS identification.
25 minAdvanced
JA4TScan - TCP Scan Detection
Detect and classify network scanners using passive TCP fingerprinting.
20 minIntermediate
JA4SSH - SSH Traffic Analysis
Classify SSH sessions and detect tunneling patterns from encrypted traffic.
10 minBeginner
Wireshark JA4 Plugin
Install and use the official JA4+ Wireshark plugin for live packet analysis.

Advanced Labs

View all
Advanced
Capturing Live Traffic with JA4H
Capture and analyze real HTTP traffic using tshark and JA4H fingerprinting for threat detection.
Advanced
Malware Detection with JA4+
Identify malware families, C2 beacons, and lateral movement using JA4+ fingerprint correlation.

Recommended Learning Path

1

Foundations

JA4, JA4S, Wireshark Plugin

2

HTTP & TCP

JA4H, JA4T, JA4TS

3

Detection

JA4TScan, JA4SSH

4

Advanced

Capturing Traffic, Malware Detection