How to Detect Cookies, Headless Browsers, and CLI Tools | Cybersecurity Blog | Grey Noise

Summary: GreyNoise added three new tags to its fingerprinting for HTTP-based protocols, extending its existing JA3 and HASSH client identification to show how internet background noise-makers manage internal state. The tags let analysts infer tooling - for example, an IP carrying a referer header, accepting cookies, and following redirects indicates a full-featured browser such as Puppeteer is being used to scan the internet.
Why it matters: Each tag alone is only a small signal, but viewed together they can tie two IPs to the same tooling - giving analysts a way to track a single actor across addresses even when the exploit vector or payload stays the same.

Read the original at GreyNoise Blog ↗