Menu
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill tls-fingerprint-impersonationThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
| name | tls-fingerprint-impersonation |
| description | Spoof TLS ClientHello and JA4 fingerprints for browser impersonation. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, httpx, python3 |
| tags | ["recon","TLS","JA3","JA4","fingerprint","impersonation","HTTP","browser"] |
| category | recon |
| related_skills | ["http2-header-impersonation","stealth-browser-launch","humanize-automation"] |
Spoof TLS ClientHello parameters — cipher suites, key exchange groups, signature algorithms, and extension order — to match real browsers at the JA3/JA4 fingerprint level. Uses patched rustls to rebuild the TLS layer with browser-identical configurations. Bypasses TLS fingerprinting detection (Cloudflare, Akamai, F5) that flags non-browser TLS stacks. Supports 20 browser profiles including Chrome 100-142, Firefox 128-144, Safari iOS 18, and OkHttp 3-5 (Android).
terminal with python3.pip install impit (wraps the Rust library via PyO3).npm install impit (native binding).impit crate with patched dependencies in Cargo.toml.# Check if a target blocks non-browser TLS
curl --max-time 30 --connect-timeout 10 -sk https://target.com | head -1
# If 403, test with browser impersonation:
python3 -c "
from impit import Impit
impit = Impit.builder().with_fingerprint('chrome142').build()
r = impit.get('https://target.com').text
print(r[:200])
"
Choose the right fingerprint for your target:
| Profile | Use case | Key differentiator |
|---|---|---|
chrome142 | Modern desktop | Latest Chrome, post-quantum KEX (X25519MLKEM768), GREASE |
chrome100 | Legacy systems | Older cipher suites, no GREASE in key exchange |
firefox144 | Firefox desktop | Different pseudo-header order, FFDHE groups, SHA-1 signatures |
safari_ios18 |
| iOS mobile |
| 3DES ciphers, duplicate signature algorithm, no session tickets |
okhttp4 | Android apps | BoringSSL profile, no GREASE, no ECH, simpler cipher suites |
chrome124 | Common default | Good balance of modern compatibility and detection pass rate |
from impit import Impit
# Chrome 142 (latest)
client = Impit.builder().with_fingerprint("chrome142").build()
# Firefox 144
client = Impit.builder().with_fingerprint("firefox144").build()
# Safari iOS 18 (mobile API endpoints)
client = Impit.builder().with_fingerprint("ios18").build()
# OkHttp 4 (Android app impersonation)
client = Impit.builder().with_fingerprint("okhttp4").build()
from impit import Impit
impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_ignore_tls_errors(True) # for self-signed certs during recon
.with_http3() # HTTP/3 support
.with_fallback_to_vanilla(True) # retry without fingerprint if blocked
.build()
)
response = impit.get("https://target.com")
print(response.status_code)
print(response.headers)
print(response.text()[:500])
impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_proxy("http://user:pass@residential-proxy:8080")
.with_default_timeout(15_000) # 15 seconds in milliseconds
.build()
)
response = impit.get("https://target.com/api/endpoint")
# Custom headers are merged with fingerprint defaults
# Fingerprint headers have lower priority — custom headers win on conflict
response = impit.get(
"https://target.com/api/v1",
headers={
"X-Forwarded-For": "[REDACTED_IP]",
"Authorization": "Bearer token",
}
)
from impit.cookie import Jar
impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_cookie_store(Jar()) # persistent cookie jar
.build()
)
# Login
impit.post("https://target.com/login", json={
"username": "admin", "password": "admin"
})
# Authenticated request — cookies preserved automatically
response = impit.get("https://target.com/dashboard")
Choose based on target characteristics:
def select_fingerprint(target_url):
"""Auto-select browser fingerprint based on target."""
if "mobile" in target_url or "api/v2" in target_url:
return "ios18"
elif "android" in target_url or "play.google" in target_url:
return "okhttp4"
elif target_url.startswith("https://"):
return "chrome142" # default for modern HTTPS
return "chrome124"
Verify your TLS fingerprint is working correctly:
# Test against a site that returns JA4 hash in response headers
python3 -c "
from impit import Impit
impit = Impit.builder().with_fingerprint('chrome142').build()
r = impit.get('https://cloudflare.com/cdn-cgi/trace')
print(r.text())
# Look for JA4 hash in trace output or response headers
"
| Feature | Chrome 142 | Firefox 144 | Safari iOS 18 | OkHttp 4 |
|---|---|---|---|---|
| TLS versions | 1.3 + 1.2 | 1.3 + 1.2 | 1.3 + 1.2 | 1.3 + 1.2 |
| GREASE cipher | ✅ (pos 1) | ❌ | ✅ | ❌ |
| GREASE key exchange | ✅ (pos 1) | ❌ | ✅ | ❌ |
| Post-quantum (MLKEM768) | ✅ | ✅ | ✅ | ❌ |
| FFDHE groups | ❌ | ✅ (2048/3072) | ❌ | ❌ |
| SHA-1 signatures | ❌ | ✅ | ✅ (legacy) | ✅ (RSA only) |
| ECH GREASE | ✅ | ✅ | ❌ | ❌ |
| 3DES ciphers | ❌ | ❌ | ✅ | ❌ |
| Certificate compression | Brotli | Zlib+Brotli+Zstd | Zlib | ❌ |
| Delegated credentials | ❌ | ✅ | ❌ | ❌ |
| Session tickets | ✅ | ✅ | ❌ | ✅ |
| Duplicate signatures | ❌ | ❌ | ✅ (RsaPssRsaSha384) | ❌ |
| Browser | Stream Window | Connection Window | Pseudo-Header Order |
|---|---|---|---|
| Chrome | 6,291,456 | 15,663,105 | :method :authority :scheme :path |
| Firefox | 131,072 | 12,517,377 | :method :path :authority :scheme |
| Safari iOS | 2,097,152 | 10,485,760 | :method :scheme :authority :path |
| OkHttp | 16,777,216 | 16,777,216 | :method :path :authority :scheme |
| Browser | Format | Example |
|---|---|---|
| Chrome | ----WebKitFormBoundary + 16 alphanumeric | ----WebKitFormBoundaryx8fH3kLm9pQr2sTv |
| Firefox | ----geckoformboundary + hex u64 values | ----geckoformboundary3fa8c10e5d6b2904 |
| OkHttp | UUID v4 | 550e8400-e29b-41d4-a716-446655440000 |
with_http3() flag only matters for sites that support it.CryptoProvider instances are cached per fingerprint — subsequent requests are fast.vanilla_fallback if stealth is critical.https://www.howsmyssl.com/ or Cloudflare trace endpoint.cf-ja4 response header when hitting Cloudflare-protected sites.http2-header-impersonation — HTTP/2 pseudo-header ordering and SETTINGS frame matching.stealth-browser-launch — Full browser automation with C++ fingerprint patches for JS-heavy targets.humanize-automation — Human-like interaction patterns for behavioral detection bypass.