chatnest.ir/SNISPF
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

change

Browse Source
This commit is contained in:
nouri_a
2026-04-16 14:15:33 +03:30
parent 1bad6394d1
commit d3486c0458
4 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18 -18
View File
@@ -143,7 +143,7 @@ docker run --rm -p 40443:40443 snispf
The simplest way to start -- using the default settings:
```bash
snispf -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com
snispf -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com
```
What each part means:
@@ -151,8 +151,8 @@ What each part means:
| Flag | What it does | Example value |
|---|---|---|
| `-l` | The local address and port SNISPF listens on | `0.0.0.0:40443` (all interfaces, port 40443) |
| `-c` | The real server IP and port to forward traffic to | `188.114.98.0:443` (a Cloudflare IP) |
| `-s` | The fake website name to show the firewall | `auth.vercel.com` (an allowed domain) |
| `-c` | The real server IP and port to forward traffic to | `5.10.249.0:443` (a Cloudflare IP) |
| `-s` | The fake website name to show the firewall | `vercel.com` (an allowed domain) |
> **Tip:** If you're not sure what IP or fake SNI to use, the defaults above work for many Cloudflare-based setups.
@@ -191,13 +191,13 @@ snispf --config config.json
```bash
# Basic usage
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com
# Use the strongest bypass method
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# See verbose debug output
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -v
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -v
# Check what your system supports
snispf --info
@@ -211,9 +211,9 @@ Here's what each field in `config.json` does:
{
"LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0",
"CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com",
"FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment",
"FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1,
@@ -226,9 +226,9 @@ Here's what each field in `config.json` does:
|---|---|---|
| `LISTEN_HOST` | IP address to listen on. `0.0.0.0` means all network interfaces. | `0.0.0.0` |
| `LISTEN_PORT` | Port number to listen on locally. | `40443` |
| `CONNECT_IP` | The real server's IP address to forward traffic to. | `188.114.98.0` |
| `CONNECT_IP` | The real server's IP address to forward traffic to. | `5.10.249.0` |
| `CONNECT_PORT` | The real server's port. | `443` |
| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `auth.vercel.com` |
| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `vercel.com` |
| `BYPASS_METHOD` | Which bypass technique to use: `fragment`, `fake_sni`, or `combined`. | `fragment` |
| `FRAGMENT_STRATEGY` | How to split the hello message: `sni_split`, `half`, `multi`, or `tls_record_frag`. | `sni_split` |
| `FRAGMENT_DELAY` | How long to wait between sending fragments (in seconds). | `0.1` |
@@ -308,10 +308,10 @@ Uses both methods at the same time: injects a fake hello (if root is available),
**Without root:** Fragments only (the fake injection is skipped since it can't be done safely without raw sockets).
```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# On Linux, run with sudo for the full seq_id trick:
sudo snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
sudo snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
```
---
@@ -330,7 +330,7 @@ These control *how* the hello message gets split up (used by `fragment` and `com
Example:
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
```
---
@@ -373,22 +373,22 @@ Try these steps in order:
1. **Switch bypass method:** `fragment` -> `combined` -> `fake_sni`
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
```
2. **Try different fragment strategies:** `sni_split` -> `multi` -> `tls_record_frag`
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
```
3. **Increase the delay between fragments:**
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-delay 0.2
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-delay 0.2
```
4. **Try a different fake SNI.** Pick a major website that's not blocked in your area:
```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com
```
5. **Double-check the target IP and port.** Make sure `CONNECT_IP` actually points to the server you want.
@@ -407,7 +407,7 @@ On Linux, consider using `combined` or `fake_sni` with `sudo` instead. The raw i
On Linux, run as root. This enables raw packet injection which is the same technique as the original [patterniha tool](https://github.com/patterniha/SNI-Spoofing):
```bash
sudo snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined
sudo snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
```
### How do I check what my system supports?
config.json
+2 -2
View File
@@ -1,9 +1,9 @@
{
"LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0",
"CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com",
"FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment",
"FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1,
sni_spoofing/cli.py
+14 -14
View File
@@ -6,7 +6,7 @@ On Linux with root, enables raw packet injection for the seq_id trick.
Usage:
snispf --config config.json
snispf --listen 0.0.0.0:40443 --connect 188.114.98.0:443 --sni auth.vercel.com
snispf --listen 0.0.0.0:40443 --connect 5.10.249.0:443 --sni vercel.com
"""
import argparse
@@ -90,10 +90,10 @@ def setup_logging(verbose: bool = False, quiet: bool = False):
DEFAULT_CONFIG = {
"LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0",
"CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com",
"BYPASS_METHOD": "fragment",
"FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fake_sni",
"FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1,
"USE_TTL_TRICK": False,
@@ -124,10 +124,10 @@ def generate_config(output_path: str):
config = {
"LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0",
"CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com",
"BYPASS_METHOD": "fragment",
"FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fake_sni",
"FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1,
"USE_TTL_TRICK": False,
@@ -152,7 +152,7 @@ def build_strategy(config: dict, raw_injector=None) -> BypassStrategy:
for the seq_id trick; falls back to fragmentation without them)
- "combined": Both fragmentation and fake SNI (recommended)
"""
method = config.get("BYPASS_METHOD", "fragment").lower()
method = config.get("BYPASS_METHOD", "fake_sni").lower()
if method == "fragment":
return FragmentBypass(
@@ -192,8 +192,8 @@ def parse_args():
epilog=(
"Examples:\n"
" %(prog)s --config config.json\n"
" %(prog)s -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com\n"
" %(prog)s -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined\n"
" %(prog)s -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com\n"
" %(prog)s -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined\n"
" %(prog)s --generate-config my_config.json\n"
"\nBypass Methods:\n"
" fragment - Fragment TLS ClientHello at SNI boundary (default)\n"
@@ -228,12 +228,12 @@ def parse_args():
parser.add_argument(
"--connect", "-c",
metavar="IP:PORT",
help="Target server address (default: 188.114.98.0:443)",
help="Target server address (default: 5.10.249.0:443)",
)
parser.add_argument(
"--sni", "-s",
metavar="HOSTNAME",
help="Fake SNI hostname (default: auth.vercel.com)",
help="Fake SNI hostname (default: vercel.com)",
)
# Bypass settings
@@ -372,7 +372,7 @@ def main():
config["LISTEN_PORT"] = port
if args.connect:
host, port = parse_host_port(args.connect, "188.114.98.0", 443)
host, port = parse_host_port(args.connect, "5.10.249.0", 443)
config["CONNECT_IP"] = host
config["CONNECT_PORT"] = port
@@ -410,7 +410,7 @@ def main():
# Try to start raw injector (Linux + root only)
raw_injector = None
use_raw = not getattr(args, 'no_raw', False)
method = config.get("BYPASS_METHOD", "fragment").lower()
method = config.get("BYPASS_METHOD", "fake_sni").lower()
if use_raw and method in ("fake_sni", "combined") and interface_ip:
if is_raw_available():
tests/test_tls.py
+2 -2
View File
@@ -41,7 +41,7 @@ class TestClientHelloBuilder(unittest.TestCase):
def test_build_client_hello_contains_sni(self):
"""Test that built ClientHello contains the specified SNI."""
sni = "auth.vercel.com"
sni = "vercel.com"
hello = ClientHelloBuilder.build_client_hello(sni=sni)
# The SNI should be present in the packet
@@ -72,7 +72,7 @@ class TestClientHelloBuilder(unittest.TestCase):
def test_parse_client_hello_roundtrip(self):
"""Test build and parse roundtrip."""
sni = "auth.vercel.com"
sni = "vercel.com"
hello = ClientHelloBuilder.build_client_hello(sni=sni)
parsed = ClientHelloBuilder.parse_client_hello(hello)