wgcf is an unofficial, cross-platform command-line tool for Cloudflare WARP. It reverse-engineers the official Android client's undocumented API to register WARP accounts, bind license keys, and emit ready-to-use WireGuard profiles. The codebase is organized as a Cobra-based CLI with distinct subcommands (register, update, generate, status, trace), a Viper-backed TOML config layer, a custom OpenAPI-generated API client for api.cloudflareclient.com, and a dedicated WireGuard profile generator. Its most distinctive piece is a uTLS-based HTTP transport that replicates the exact TLS ClientHello of Cloudflare's Android app, allowing the tool to pass server-side fingerprint checks. The OpenAPI specification is actively maintained and version-pinned to WARP build 5641, with generated Go client code that should be regenerated when the spec changes. This is a pure application repository; the only data-like artifacts are the OpenAPI contract and schema models, which serve the client rather than enable research or analytics.
This repository is a Go HTTP client library named 'req' (module github.com/imroc/req/v3). It provides a high-level, fluent API for making HTTP requests with extensive features including HTTP/1.1, HTTP/2, and HTTP/3 support, automatic retries with configurable backoff and conditions, middleware chains for request/response processing, TLS fingerprint impersonation (via uTLS), bandwidth rate limiting, parallel file downloads, digest authentication, and detailed debugging capabilities (dump, trace, curl command generation). The library is designed for production use, with a focus on ease of use and flexibility, allowing developers to build custom SDKs on top of it. The architecture centers around a Client struct that holds configuration and a Transport that wraps net/http with additional capabilities. Requests are built using a builder pattern (R() method) and executed via method-specific helpers (Get, Post, etc.). The codebase includes a significant amount of internal code forked from Go's standard library (HTTP/2, chunked encoding) and third-party dependencies (quic-go for HTTP/3, brotli, zstd). It is a pure application library with no data analysis or research components.
JA4+ is a multi-protocol passive network fingerprinting suite that generates deterministic fingerprints for TLS, HTTP, SSH, TCP, DHCP, X.509, and latency characteristics. The repository provides four independent implementations: a Python reference library, a Rust CLI tool and library, a Wireshark post-dissector plugin, and a Zeek plugin (C++ BiF + Zeek scripts). All implementations share the same fingerprinting algorithm, test pcap files, and expected output snapshots, enabling cross-validation. The system processes raw packet captures (PCAP/PCAPNG) via tshark or direct packet parsing, extracts protocol handshake parameters (cipher suites, extensions, HTTP headers, SSH key exchange algorithms, TCP flags, DHCP options), normalizes them (GREASE removal, sorting, hashing), and outputs structured JA4+ fingerprints. External dependencies include tshark (for PCAP parsing in Python and Rust), Wireshark/Zeek APIs for plugins, and the ja4db.com database for fingerprint-to-software mapping. The architecture is a collection of standalone tools rather than a unified service, with each implementation optimized for its target environment (CLI, packet analyzer, network monitor). While primarily an application toolkit, the repository also includes research-oriented assets such as a fingerprint-to-software mapping CSV, technical documentation with diagrams, and a large corpus of real-world test traffic, making it a hybrid of production tooling and security research.
NaïveProxy is a censorship circumvention proxy that repurposes Chromium's network stack to mimic genuine Chrome HTTPS traffic at the TLS, HTTP/2, and QUIC protocol levels. The repository is a heavily trimmed Chromium source tree with custom patches for traffic padding, SOCKS5 client support, and a padding layer between proxy endpoints. It produces a statically linked `naive` binary (client and server) and an Android APK plugin (SagerNet). The architecture is a monolithic executable that bundles Chromium's networking libraries (BoringSSL, HTTP/2, QUIC) with a thin custom layer for configuration parsing and protocol padding. Key entry points are the `naive` binary (via command-line and config.json) and the Android plugin service. External dependencies include the Chromium source base (fetched at build time), BoringSSL, and system libs. The custom components (padding framer, config parser) are small, well-tested, and can be extracted for reuse in other proxy or traffic analysis projects.