Using fuzzing for automated probe message generation in remote black-box TLS fingerprinting

Secure network communication is critical across various domains for both functional safety and user acceptance, particularly in IoT environments where Cyber-Physical Systems bridge the physical world and cyberspace. Remote software implementation and version identification (fingerprinting) provide valuable intelligence for security operations specialists and penetration testers. Existing fingerprinting tools, however, rely on manually crafted probe sets that demand deep protocol expertise and may miss subtle behavioral differences. This paper presents an automated approach for black-box remote TLS implementation fingerprinting using differential testing combined with evolutionary fuzzing techniques. Our evolutionary fuzzing algorithm effectively discovers numerous behavioral discrepancies across different TLS implementations. The methodology leverages the Generic Message Tree (GMT) representation, enabling the production of diverse and mostly valid protocol messages. Our experimental study covers 323 TLS server implementations from six major brands. We apply a clustering approach to measure the efficiency of different fingerprinting configurations. Probes generated by our fuzzing approach distinguish about 3.5 times as many behavioral clusters as existing comparable software: a minimal set of just 35 automatically generated probes separates the 323 implementations into 155 clusters. On our reference set these clusters yield complete brand identification and narrow a target to a small range of same-brand versions.