DEF CON 33 - Fingerprint-Based Bot Blocking & Dynamic Deception - Adel Karimi

[BLUF: Adel introduces Finch, a fingerprint-aware reverse proxy that uses TLS and HTTP fingerprints to detect, block, and deceive attackers, with real-time log analysis powered by AI agents. This tool enables smarter threat response, resource protection, and pattern discovery in security logs.]2:04

Key Takeaways:
• Finch is a lightweight, open-source reverse proxy that uses client fingerprints (TLS, HTTP, HTTP/2) to detect and act on traffic, enabling dynamic blocking, routing, or deception 2:58.
• It supports advanced fingerprinting like Jotree (TLS), Jotree 4 (HTTP), and HTTP/2 frame analysis to identify tools like Burp Suite or ZAP with high precision 17:48.
• The tool includes a built-in AI agent that analyzes logs, detects patterns (e.g., rotating TLS fingerprints), and automatically creates blocking rules via an admin API 35:01.
• Users can deploy the tool in echo mode to generate fingerprint datasets, and leverage real-time SSE logs for monitoring and filtering 35:16.
• The AI agent demonstrates that LLMs must be paired with tool use (e.g., Python interpreter) to perform actual analysis—without tool use, LLMs generate false results 41:13.

[Closing statement: Finch enables defenders to detect, respond to, and analyze malicious traffic more effectively through intelligent fingerprinting and AI-driven automation.]

Sources:

• 2:04 Introduction to Finch and its core purpose
• 2:58 Why reverse proxy level fingerprinting improves traffic analysis
• 17:48 Fingerprinting techn