{"repo":"0x4D31/finch","free":true,"listed":false,"github":"https://github.com/0x4D31/finch","clone":"git clone https://github.com/0x4D31/finch.git","description":"Fingerprint-aware TLS reverse proxy. Use Finch to outsmart bad traffic—collect client fingerprints (JA3, JA4 +QUIC, JA4H, HTTP/2) and act on them: block, reroute, tarpit, or deceive in real time.","language":"Go","stars":303,"topics":["fingerprint","go","reverse-proxy","security","deception","fingerprinting","honeypot","ja3","ja4","security-tools"],"license":"Apache-2.0","category":"networking-infra","readme_excerpt":"Fingerprint‑Aware TLS Reverse Proxy Finch is a lightweight reverse proxy written in Go. It inspects TLS handshakes and HTTP requests to extract JA3, JA4, JA4H, and Akamai HTTP/2 fingerprints, then evaluates them—alongside the rest of the request metadata—against flexible, hot‑reloadable rules written in HCL. On a per‑request basis, Finch can: - allow legitimate traffic - deny unwanted traffic - route clients to alternate upstreams - deceive attackers with on‑the‑fly, LLM‑generated responses via Galah - tarpit scanners with slow drip responses Finch also offers an authenticated admin API for live configuration and rule updates, a real‑time SSE feed for observability, Suricata HTTP rule matching, and an echo mode for testing or dataset collection. Experimental HTTP/3 and QUIC fingerprinting support is included. Use Finch to block scrapers and other unwanted traffic, slow down scanners, or deploy dynamic honeypots. Status: v0.1.0 – not production‑ready. Finch is under active development and may contain bugs or breaking changes. Please test thoroughly before deploying, and open an issue or pull request if you find a problem or can contribute improvements. Key Features - Fingerprint extraction – Capture JA3, JA4, JA4H, and Akamai HTTP/2 fingerprints for every request, providing high‑fidelity identification of client libraries and TLS stacks. - Flexible rule engine – Define policies using HCL that evaluate fingerprints, HTTP methods and paths, header values, source‑IP ranges, and S","default_branch":null,"files":null,"tree":[],"storefront":"/r/0x4D31","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/0x4D31/finch/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}