Constant-Time Analysis
trailofbits/skills
Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonation --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .claude/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .claude/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonationType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonation --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .agents/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .agents/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonation --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .cursor/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .cursor/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/uphiago/recon-skills.git --path recon/tls-fingerprint-impersonation--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonation --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .gemini/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .gemini/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonationInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .github/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .github/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install uphiago/recon-skills tls-fingerprint-impersonation --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/uphiago/recon-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/recon/tls-fingerprint-impersonation .opencode/skills/tls-fingerprint-impersonation && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "tls-fingerprint-impersonation" agent skill from https://github.com/uphiago/recon-skills/tree/main/recon/tls-fingerprint-impersonation into .opencode/skills/tls-fingerprint-impersonation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tls-fingerprint-impersonation", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
tls-fingerprint-impersonationSpoof TLS ClientHello and JA4 fingerprints for browser impersonation.
Tls Fingerprint Impersonation is an agent skill from uphiago/recon-skills. Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Requires curl, httpx, python3
It sits in Security, covering Cryptography. It works with Rust and iOS. The repository describes itself as: Recon & pentest skill pack. CORS, XSS, SQLi, SSRF, RCE, WordPress, MCP, cloud, subdomain takeover, and more. Field-tested. MIT. Full write-up at hiago.sh. The licence is MIT.
7 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 1260244. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
python3curlpipnpmFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
howsmyssl.comcloudflare.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Requires curl, httpx, python3
From compatibility in the SKILL.md frontmatter.
Tls Fingerprint Impersonation loads about 2.1k tokens when it runs. Until then it costs about 25 tokens; SKILL.md has 577 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from uphiago/recon-skills at commit 1260244, republished under its MIT licence (© uphiago). 577 words, ~2,099 tokens.
.claude/skills/tls-fingerprint-impersonation/SKILL.md (or your agent's skills folder).Spoof TLS ClientHello parameters — cipher suites, key exchange groups, signature algorithms, and extension order — to match real browsers at the JA3/JA4 fingerprint level. Uses patched rustls to rebuild the TLS layer with browser-identical configurations. Bypasses TLS fingerprinting detection (Cloudflare, Akamai, F5) that flags non-browser TLS stacks. Supports 20 browser profiles including Chrome 100-142, Firefox 128-144, Safari iOS 18, and OkHttp 3-5 (Android).
terminal with python3.pip install impit (wraps the Rust library via PyO3).npm install impit (native binding).impit crate with patched dependencies in Cargo.toml.# Check if a target blocks non-browser TLS
curl --max-time 30 --connect-timeout 10 -sk https://target.com | head -1
# If 403, test with browser impersonation:
python3 -c "
from impit import Impit
impit = Impit.builder().with_fingerprint('chrome142').build()
r = impit.get('https://target.com').text
print(r[:200])
"Choose the right fingerprint for your target:
| Profile | Use case | Key differentiator |
|---|---|---|
chrome142 | Modern desktop | Latest Chrome, post-quantum KEX (X25519MLKEM768), GREASE |
chrome100 | Legacy systems | Older cipher suites, no GREASE in key exchange |
firefox144 | Firefox desktop | Different pseudo-header order, FFDHE groups, SHA-1 signatures |
safari_ios18 | iOS mobile | 3DES ciphers, duplicate signature algorithm, no session tickets |
okhttp4 | Android apps | BoringSSL profile, no GREASE, no ECH, simpler cipher suites |
chrome124 | Common default | Good balance of modern compatibility and detection pass rate |
from impit import Impit
# Chrome 142 (latest)
client = Impit.builder().with_fingerprint("chrome142").build()
# Firefox 144
client = Impit.builder().with_fingerprint("firefox144").build()
# Safari iOS 18 (mobile API endpoints)
client = Impit.builder().with_fingerprint("ios18").build()
# OkHttp 4 (Android app impersonation)
client = Impit.builder().with_fingerprint("okhttp4").build()from impit import Impit
impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_ignore_tls_errors(True) # for self-signed certs during recon
.with_http3() # HTTP/3 support
.with_fallback_to_vanilla(True) # retry without fingerprint if blocked
.build()
)
response = impit.get("https://target.com")
print(response.status_code)
print(response.headers)
print(response.text()[:500])impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_proxy("http://user:pass@residential-proxy:8080")
.with_default_timeout(15_000) # 15 seconds in milliseconds
.build()
)
response = impit.get("https://target.com/api/endpoint")# Custom headers are merged with fingerprint defaults
# Fingerprint headers have lower priority — custom headers win on conflict
response = impit.get(
"https://target.com/api/v1",
headers={
"X-Forwarded-For": "[REDACTED_IP]",
"Authorization": "Bearer token",
}
)from impit.cookie import Jar
impit = (
Impit.builder()
.with_fingerprint("chrome142")
.with_cookie_store(Jar()) # persistent cookie jar
.build()
)
# Login
impit.post("https://target.com/login", json={
"username": "admin", "password": "admin"
})
# Authenticated request — cookies preserved automatically
response = impit.get("https://target.com/dashboard")Choose based on target characteristics:
def select_fingerprint(target_url):
"""Auto-select browser fingerprint based on target."""
if "mobile" in target_url or "api/v2" in target_url:
return "ios18"
elif "android" in target_url or "play.google" in target_url:
return "okhttp4"
elif target_url.startswith("https://"):
return "chrome142" # default for modern HTTPS
return "chrome124"Verify your TLS fingerprint is working correctly:
# Test against a site that returns JA4 hash in response headers
python3 -c "
from impit import Impit
impit = Impit.builder().with_fingerprint('chrome142').build()
r = impit.get('https://cloudflare.com/cdn-cgi/trace')
print(r.text())
# Look for JA4 hash in trace output or response headers
"| Feature | Chrome 142 | Firefox 144 | Safari iOS 18 | OkHttp 4 |
|---|---|---|---|---|
| TLS versions | 1.3 + 1.2 | 1.3 + 1.2 | 1.3 + 1.2 | 1.3 + 1.2 |
| GREASE cipher | ✅ (pos 1) | ❌ | ✅ | ❌ |
| GREASE key exchange | ✅ (pos 1) | ❌ | ✅ | ❌ |
| Post-quantum (MLKEM768) | ✅ | ✅ | ✅ | ❌ |
| FFDHE groups | ❌ | ✅ (2048/3072) | ❌ | ❌ |
| SHA-1 signatures | ❌ | ✅ | ✅ (legacy) | ✅ (RSA only) |
| ECH GREASE | ✅ | ✅ | ❌ | ❌ |
| 3DES ciphers | ❌ | ❌ | ✅ | ❌ |
| Certificate compression | Brotli | Zlib+Brotli+Zstd | Zlib | ❌ |
| Delegated credentials | ❌ | ✅ | ❌ | ❌ |
| Session tickets | ✅ | ✅ | ❌ | ✅ |
| Duplicate signatures | ❌ | ❌ | ✅ (RsaPssRsaSha384) | ❌ |
| Browser | Stream Window | Connection Window | Pseudo-Header Order |
|---|---|---|---|
| Chrome | 6,291,456 | 15,663,105 | :method :authority :scheme :path |
| Firefox | 131,072 | 12,517,377 | :method :path :authority :scheme |
| Safari iOS | 2,097,152 | 10,485,760 | :method :scheme :authority :path |
| OkHttp | 16,777,216 | 16,777,216 | :method :path :authority :scheme |
| Browser | Format | Example |
|---|---|---|
| Chrome | ----WebKitFormBoundary + 16 alphanumeric | ----WebKitFormBoundaryx8fH3kLm9pQr2sTv |
| Firefox | ----geckoformboundary + hex u64 values | ----geckoformboundary3fa8c10e5d6b2904 |
| OkHttp | UUID v4 | 550e8400-e29b-41d4-a716-446655440000 |
with_http3() flag only matters for sites that support it.CryptoProvider instances are cached per fingerprint — subsequent requests are fast.vanilla_fallback if stealth is critical.https://www.howsmyssl.com/ or Cloudflare trace endpoint.cf-ja4 response header when hitting Cloudflare-protected sites.http2-header-impersonation — HTTP/2 pseudo-header ordering and SETTINGS frame matching.stealth-browser-launch — Full browser automation with C++ fingerprint patches for JS-heavy targets.humanize-automation — Human-like interaction patterns for behavioral detection bypass.© uphiago, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in recon/tls-fingerprint-impersonation of uphiago/recon-skills.
Open the folder on GitHubat commit 1260244
Tls Fingerprint Impersonation next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Tls Fingerprint Impersonation this skilluphiago/recon-skills | 1.3k | — | ~2.1k | Automated safety check: Pass | MIT | |
| Constant-Time Analysistrailofbits/skills | 7.5k | — | ~3.3k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Azure Keyvault Keys Rustaiskillstore/marketplace | 433 | 4 repos | ~1.1k | Automated safety check: Pass | None | |
| Pump Securitynirholas/pump-fun-sdk | 134 | — | ~892 | Automated safety check: Pass | Custom licence | |
| Azure Keyvault Keys Rustmicrosoft/skills | 3.1k | — | ~1.9k | Automated safety check: Pass | MIT |
trailofbits/skills
Compiles cryptographic code and inspects the assembly or bytecode for variable-time instructions, then triages which flagged operations actually touch secrets.
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
aiskillstore/marketplace
Azure Key Vault Keys SDK for Rust. An agent skill from aiskillstore/marketplace.
nirholas/pump-fun-sdk
Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency…
microsoft/skills
Azure Key Vault Keys library for Rust. An agent skill from microsoft/skills.
HoangNguyen0403/agent-skills-standard
Probe for hardcoded secrets, injection surfaces, unguarded routes, business logic flaws, and platform-specific weaknesses across backend (Node, Go, Java, Python, Rust), frontend (React, Angular…
uphiago/recon-skills
Flags API endpoints whose data or actions look like they should need a login but currently don't, as part of authorized security testing.
uphiago/recon-skills
Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills.
uphiago/recon-skills
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
uphiago/recon-skills
A skill your agent uses when starting or restructuring an authorized external web and API assessment.
uphiago/recon-skills
Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
uphiago/recon-skills
A skill your agent uses when protected HTTP routes return 401 or 403.
Categories
Spoof TLS ClientHello and JA4 fingerprints for browser impersonation. Tls Fingerprint Impersonation is an agent skill from uphiago/recon-skills. Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.
Tls Fingerprint Impersonation fits situations like: tasks that involve Cryptography.
Run `npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a claude-code`. Or copy the skill folder (recon/tls-fingerprint-impersonation in uphiago/recon-skills) into .claude/skills/tls-fingerprint-impersonation in your project. Claude Code loads it when a task matches its description.
Run `npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a codex`. Or copy the skill folder (recon/tls-fingerprint-impersonation in uphiago/recon-skills) into .agents/skills/tls-fingerprint-impersonation in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add uphiago/recon-skills --skill tls-fingerprint-impersonation -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/tls-fingerprint-impersonation, .gemini/skills/tls-fingerprint-impersonation, .github/skills/tls-fingerprint-impersonation and .opencode/skills/tls-fingerprint-impersonation in your project.
Going by SKILL.md and its folder, Tls Fingerprint Impersonation needs the command-line tools its instructions call (python3, curl, pip and npm). Our summary lists: Python 3; Node.js. Compatibility (from SKILL.md): Requires curl, httpx, python3.
SKILL.md names 2 domains. In commands or code: howsmyssl.com and cloudflare.com; the agent is likely to contact these when it follows the instructions. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Tls Fingerprint Impersonation is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.1k tokens (SKILL.md is roughly 8.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Tls Fingerprint Impersonation: Constant-Time Analysis (trailofbits/skills, 7.5k stars), Security Review (github/awesome-copilot, 40k stars), Azure Keyvault Keys Rust (aiskillstore/marketplace, 433 stars) and Pump Security (nirholas/pump-fun-sdk, 134 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
uphiago (a GitHub user) maintains it in uphiago/recon-skills, which has 1,293 GitHub stars. The repository holds 23 skills in this directory. The repository was last updated on September 1, 2026.
Source: uphiago/recon-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.