JARM — TLS Server Fingerprinting for Threat Hunting

★ 1.3K

JARM is Salesforce's open-source active TLS server fingerprinting tool: it probes a server and returns a short hash that captures how its TLS is configured. People reach for it when they need to quickly verify that all servers in a group share the same TLS configuration, when they want to group disparate servers on the internet by configuration and tell whether a server belongs to Google, Salesforce or Apple, when they need to identify default applications and infrastructure, or when they hunt for malware command-and-control and other malicious servers. Inside is a Python script: jarm.py takes a domain or IP, a port, an input list of targets and a proxy, and can write results to a file, while jarm.sh runs a large list of addresses at speed into a CSV. JARM support has been added to Shodan, Censys, SecurityTrails, BinaryEdge, RiskIQ and Palo Alto Networks, so a hash you find can be searched for there too. JARM is not a vulnerability scanner — it is a way to compare and classify servers by their TLS behavior. It is a dual-use tool: scan only your own systems or ones you are authorized to test.