loading
Loading content
loading
Recon
Active JARM TLS fingerprinting via zgrab2.
overview
zgrab2-jarm sends crafted TLS Client Hello probes and hashes the server responses into a JARM fingerprint for each host.
Set --port to a TLS listener (usually 443), then tune --senders, --timeout, and --max-tries for large host lists after a port scan.
Prefer zgrab2-tls when you need certificates and handshake detail. Prefer sslyze for deep cipher auditing of one host.
source github.com/zmap/zgrab2
use cases
Compute a JARM hash for every host in a list so servers sharing the same TLS stack and configuration collapse into identifiable clusters.
Group hosts by JARM hash to see which services run the same setup, making misconfigured or outlier servers easy to spot.
Compare collected hashes to a list of known JARM signatures to flag infrastructure that matches a particular software stack or threat profile.
Feed open TLS ports from a scanner into zgrab2-jarm so each one gets a fingerprint, turning open ports into a configuration map.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | · | Input file of hosts to fingerprint. |
| port | STRING | --port | Port to grab on; set 443 for HTTPS (default 80). |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| timeout | STRING | --timeout | Set connection timeout, 0 for none (default 10s). |
| max-tries | STRING | --max-tries | Tries for timeouts and connection errors before giving up (default 1). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host (default 1). |
| trigger | STRING | --trigger | Invoke only on targets carrying the specified tag. |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
Showing key inputs. zgrab2-jarm exposes 15 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| name | STRING | --name | Name for this scan module; becomes the key for its results in the JSON output. |
| port | STRING | --port | Port to grab on; set 443 for HTTPS (default 80). |
| debug | BOOLEAN | --debug | Include debug fields in the output. |
| flush | BOOLEAN | --flush | Flush after each line of output. |
| input | STRING | · | Input target passed to the node. |
| senders | STRING | --senders | Number of send goroutines to use (default 1000). |
| timeout | STRING | --timeout | Set connection timeout, 0 for no timeout (default 10s). |
| trigger | STRING | --trigger | Invoke only on targets carrying the specified tag. |
| maxbytes | STRING | --maxbytes | Maximum byte read limit per scan (0 uses defaults). |
| max-tries | STRING | --max-tries | Number of tries for timeouts and connection errors before giving up (default 1). |
| gomaxprocs | STRING | --gomaxprocs | Set GOMAXPROCS, the maximum number of OS threads used (default 0). |
| input-file | FILE | · | Input file of hosts to fingerprint. |
| prometheus | STRING | --prometheus | Address for the Prometheus server (e.g. localhost:8080); empty disables it. |
| read-limit-per-host | STRING | --read-limit-per-host | Maximum total kilobytes to read for a single host (default 96). |
| connections-per-host | STRING | --connections-per-host | Number of times to connect to each host, producing more output (default 1). |
example
# JARM-fingerprint a list of TLS hosts on 443, three connections each for a stabler hashcat tls-hosts.txt | zgrab2 jarm --port 443 --senders 500 --timeout 10s --connections-per-host 3 > jarm.json{"ip":"198.51.100.10","domain":"api.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:11Z"}}}{"ip":"198.51.100.11","domain":"app.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:11Z"}}}{"ip":"203.0.113.5","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92d1a3"},"timestamp":"2026-06-22T14:03:12Z"}}}{"ip":"198.51.100.23","domain":"staging.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"29d29d00029d29d21c429d29d29d29da1b2c3d4e5f60718293a4b5c6d7e8f9"},"timestamp":"2026-06-22T14:03:12Z"}}}{"ip":"198.51.100.44","domain":"mail.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"15d3fd16d29d29d00042d43d000000faa598d5b3c8e2f1a0b9c8d7e6f5a4b3"},"timestamp":"2026-06-22T14:03:13Z"}}}{"ip":"198.51.100.60","domain":"vpn.example.com","data":{"jarm":{"status":"success","protocol":"jarm","result":{"fingerprint":"00000000000000000000000000000000000000000000000000000000000000"},"timestamp":"2026-06-22T14:03:13Z"}}}{"ip":"203.0.113.19","data":{"jarm":{"status":"connection-timeout","protocol":"jarm","timestamp":"2026-06-22T14:03:23Z"}}}guidance
Use to fingerprint and cluster TLS services by configuration across many hosts. Use zgrab2-tls for full certificate and handshake detail. Use sslyze to audit one host deeply.
Full TLS handshake and certificate grab. Prefer it for detail, not a single clustering hash.
TLS toolkit that also computes JARM, with broader output options.
Deep TLS configuration analyzer for one host. Prefer it to audit, not to cluster at scale.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A CIDR range feeds zmap, which finds open TLS ports and passes them to zgrab2-jarm so each service's JARM fingerprint lands as a queryable output.
Facts on this page come from the live Trickest tool library.