Recon
Cluster TLS hosts by JARM hash after a port scan
Active JARM TLS fingerprinting via zgrab2.
overview
What zgrab2-jarm does
zgrab2-jarm sends crafted TLS Client Hello probes and hashes the server responses into a JARM fingerprint for each host.
Set --port to a TLS listener (usually 443), then tune --senders, --timeout, and --max-tries for large host lists after a port scan.
Prefer zgrab2-tls when you need certificates and handshake detail. Prefer sslyze for deep cipher auditing of one host.
source github.com/zmap/zgrab2
use cases
Where zgrab2-jarm fits
Fingerprint TLS servers with JARM
Compute a JARM hash for every host in a list so servers sharing the same TLS stack and configuration collapse into identifiable clusters.
Cluster an estate by configuration
Group hosts by JARM hash to see which services run the same setup, making misconfigured or outlier servers easy to spot.
Match against known profiles
Compare collected hashes to a list of known JARM signatures to flag infrastructure that matches a particular software stack or threat profile.
Survey TLS after a port scan
Feed open TLS ports from a scanner into zgrab2-jarm so each one gets a fingerprint, turning open ports into a configuration map.
reference
zgrab2-jarm inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | · | Input file of hosts to fingerprint. |
| port | STRING | --port | Port to grab on; set 443 for HTTPS (default 80). |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| timeout | STRING | --timeout | Set connection timeout, 0 for none (default 10s). |
| max-tries | STRING | --max-tries | Tries for timeouts and connection errors before giving up (default 1). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host (default 1). |
| trigger | STRING | --trigger | Invoke only on targets carrying the specified tag. |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
Showing key inputs. zgrab2-jarm exposes 15 inputs in total.
Full flag reference (15 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| name | STRING | --name | Name for this scan module; becomes the key for its results in the JSON output. |
| port | STRING | --port | Port to grab on; set 443 for HTTPS (default 80). |
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| input | STRING | · | Input target passed to the node. |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| timeout | STRING | --timeout | Set connection timeout, 0 for no timeout (default 10s). |
| trigger | STRING | --trigger | Invoke only on targets carrying the specified tag. |
| maxbytes | STRING | --maxbytes | Maximum byte read limit per scan (0 uses defaults). |
| max-tries | STRING | --max-tries | Number of tries for timeouts and connection errors before giving up (default 1). |
| gomaxprocs | STRING | --gomaxprocs | Set GOMAXPROCS, the maximum number of OS threads used (default 0). |
| input-file | FILE | · | Input file of hosts to fingerprint. |
| prometheus | STRING | --prometheus | Address for the Prometheus server (e.g. localhost:8080); empty disables it. |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host, producing more output (default 1). |
example
Run zgrab2-jarm
# JARM-fingerprint a list of TLS hosts on 443, three connections each for a stabler hashcat tls-hosts.txt | zgrab2 jarm --port 443 --senders 500 --timeout 10s --connections-per-host 3 > jarm.json{"ip":"198.51.100.10","domain":"api.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:11Z"}}}{"ip":"198.51.100.11","domain":"app.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:11Z"}}}{"ip":"203.0.113.5","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:12Z"}}}{"ip":"198.51.100.23","domain":"staging.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"29d29d00029d29d21c429d29d29d29da1b2c3d4e5f60718293a4b5c6d7e8f9"},"timestamp":"2026-06-22T14:03:12Z"}}}{"ip":"198.51.100.44","domain":"mail.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"15d3fd16d29d29d00042d43d000000faa598d5b3c8e2f1a0b9c8d7e6f5a4b3"},"timestamp":"2026-06-22T14:03:13Z"}}}{"ip":"198.51.100.60","domain":"vpn.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"00000000000000000000000000000000000000000000000000000000000000"},"timestamp":"2026-06-22T14:03:13Z"}}}{"ip":"203.0.113.19","data":{"jarm":{"status":"connection-timeout","protocol":"jarm","timestamp":"2026-06-22T14:03:23Z"}}}guidance
Choosing zgrab2-jarm
Use to fingerprint and cluster TLS services by configuration across many hosts. Use zgrab2-tls for full certificate and handshake detail. Use sslyze to audit one host deeply.
zgrab2-tls
Full TLS handshake and certificate grab. Prefer it for detail, not a single clustering hash.
tlsx
TLS toolkit that also computes JARM, with broader output options.
sslyze
Deep TLS configuration analyzer for one host. Prefer it to audit, not to cluster at scale.
faq
zgrab2-jarm questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run zgrab2-jarm yourself
A CIDR range feeds zmap, which finds open TLS ports and passes them to zgrab2-jarm so each service's JARM fingerprint lands as a queryable output.
Facts on this page come from the live Trickest tool library.