diff --git a/README.md b/README.md index 9cea20b..3167ef9 100644 --- a/README.md +++ b/README.md @@ -143,7 +143,7 @@ docker run --rm -p 40443:40443 snispf The simplest way to start -- using the default settings: ```bash -snispf -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com +snispf -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com ``` What each part means: @@ -151,8 +151,8 @@ What each part means: | Flag | What it does | Example value | |---|---|---| | `-l` | The local address and port SNISPF listens on | `0.0.0.0:40443` (all interfaces, port 40443) | -| `-c` | The real server IP and port to forward traffic to | `188.114.98.0:443` (a Cloudflare IP) | -| `-s` | The fake website name to show the firewall | `auth.vercel.com` (an allowed domain) | +| `-c` | The real server IP and port to forward traffic to | `5.10.249.0:443` (a Cloudflare IP) | +| `-s` | The fake website name to show the firewall | `vercel.com` (an allowed domain) | > **Tip:** If you're not sure what IP or fake SNI to use, the defaults above work for many Cloudflare-based setups. @@ -191,13 +191,13 @@ snispf --config config.json ```bash # Basic usage -snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com +snispf -l :40443 -c 5.10.249.0:443 -s vercel.com # Use the strongest bypass method -snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined +snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined # See verbose debug output -snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -v +snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -v # Check what your system supports snispf --info @@ -211,9 +211,9 @@ Here's what each field in `config.json` does: { "LISTEN_HOST": "0.0.0.0", "LISTEN_PORT": 40443, - "CONNECT_IP": "188.114.98.0", + "CONNECT_IP": "5.10.249.0", "CONNECT_PORT": 443, - "FAKE_SNI": "auth.vercel.com", + "FAKE_SNI": "vercel.com", "BYPASS_METHOD": "fragment", "FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_DELAY": 0.1, @@ -226,9 +226,9 @@ Here's what each field in `config.json` does: |---|---|---| | `LISTEN_HOST` | IP address to listen on. `0.0.0.0` means all network interfaces. | `0.0.0.0` | | `LISTEN_PORT` | Port number to listen on locally. | `40443` | -| `CONNECT_IP` | The real server's IP address to forward traffic to. | `188.114.98.0` | +| `CONNECT_IP` | The real server's IP address to forward traffic to. | `5.10.249.0` | | `CONNECT_PORT` | The real server's port. | `443` | -| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `auth.vercel.com` | +| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `vercel.com` | | `BYPASS_METHOD` | Which bypass technique to use: `fragment`, `fake_sni`, or `combined`. | `fragment` | | `FRAGMENT_STRATEGY` | How to split the hello message: `sni_split`, `half`, `multi`, or `tls_record_frag`. | `sni_split` | | `FRAGMENT_DELAY` | How long to wait between sending fragments (in seconds). | `0.1` | @@ -308,10 +308,10 @@ Uses both methods at the same time: injects a fake hello (if root is available), **Without root:** Fragments only (the fake injection is skipped since it can't be done safely without raw sockets). ```bash -snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined +snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined # On Linux, run with sudo for the full seq_id trick: -sudo snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined +sudo snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined ``` --- @@ -330,7 +330,7 @@ These control *how* the hello message gets split up (used by `fragment` and `com Example: ```bash -snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi +snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi ``` --- @@ -373,22 +373,22 @@ Try these steps in order: 1. **Switch bypass method:** `fragment` -> `combined` -> `fake_sni` ```bash - snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined + snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined ``` 2. **Try different fragment strategies:** `sni_split` -> `multi` -> `tls_record_frag` ```bash - snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi + snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi ``` 3. **Increase the delay between fragments:** ```bash - snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-delay 0.2 + snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-delay 0.2 ``` 4. **Try a different fake SNI.** Pick a major website that's not blocked in your area: ```bash - snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com + snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com ``` 5. **Double-check the target IP and port.** Make sure `CONNECT_IP` actually points to the server you want. @@ -407,7 +407,7 @@ On Linux, consider using `combined` or `fake_sni` with `sudo` instead. The raw i On Linux, run as root. This enables raw packet injection which is the same technique as the original [patterniha tool](https://github.com/patterniha/SNI-Spoofing): ```bash -sudo snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined +sudo snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined ``` ### How do I check what my system supports? diff --git a/config.json b/config.json index 882f85b..c590957 100644 --- a/config.json +++ b/config.json @@ -1,9 +1,9 @@ { "LISTEN_HOST": "0.0.0.0", "LISTEN_PORT": 40443, - "CONNECT_IP": "188.114.98.0", + "CONNECT_IP": "5.10.249.0", "CONNECT_PORT": 443, - "FAKE_SNI": "auth.vercel.com", + "FAKE_SNI": "vercel.com", "BYPASS_METHOD": "fragment", "FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_DELAY": 0.1, diff --git a/sni_spoofing/cli.py b/sni_spoofing/cli.py index d054972..2ba4391 100644 --- a/sni_spoofing/cli.py +++ b/sni_spoofing/cli.py @@ -6,7 +6,7 @@ On Linux with root, enables raw packet injection for the seq_id trick. Usage: snispf --config config.json - snispf --listen 0.0.0.0:40443 --connect 188.114.98.0:443 --sni auth.vercel.com + snispf --listen 0.0.0.0:40443 --connect 5.10.249.0:443 --sni vercel.com """ import argparse @@ -90,10 +90,10 @@ def setup_logging(verbose: bool = False, quiet: bool = False): DEFAULT_CONFIG = { "LISTEN_HOST": "0.0.0.0", "LISTEN_PORT": 40443, - "CONNECT_IP": "188.114.98.0", + "CONNECT_IP": "5.10.249.0", "CONNECT_PORT": 443, - "FAKE_SNI": "auth.vercel.com", - "BYPASS_METHOD": "fragment", + "FAKE_SNI": "vercel.com", + "BYPASS_METHOD": "fake_sni", "FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_DELAY": 0.1, "USE_TTL_TRICK": False, @@ -124,10 +124,10 @@ def generate_config(output_path: str): config = { "LISTEN_HOST": "0.0.0.0", "LISTEN_PORT": 40443, - "CONNECT_IP": "188.114.98.0", + "CONNECT_IP": "5.10.249.0", "CONNECT_PORT": 443, - "FAKE_SNI": "auth.vercel.com", - "BYPASS_METHOD": "fragment", + "FAKE_SNI": "vercel.com", + "BYPASS_METHOD": "fake_sni", "FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_DELAY": 0.1, "USE_TTL_TRICK": False, @@ -152,7 +152,7 @@ def build_strategy(config: dict, raw_injector=None) -> BypassStrategy: for the seq_id trick; falls back to fragmentation without them) - "combined": Both fragmentation and fake SNI (recommended) """ - method = config.get("BYPASS_METHOD", "fragment").lower() + method = config.get("BYPASS_METHOD", "fake_sni").lower() if method == "fragment": return FragmentBypass( @@ -192,8 +192,8 @@ def parse_args(): epilog=( "Examples:\n" " %(prog)s --config config.json\n" - " %(prog)s -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com\n" - " %(prog)s -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined\n" + " %(prog)s -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com\n" + " %(prog)s -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined\n" " %(prog)s --generate-config my_config.json\n" "\nBypass Methods:\n" " fragment - Fragment TLS ClientHello at SNI boundary (default)\n" @@ -228,12 +228,12 @@ def parse_args(): parser.add_argument( "--connect", "-c", metavar="IP:PORT", - help="Target server address (default: 188.114.98.0:443)", + help="Target server address (default: 5.10.249.0:443)", ) parser.add_argument( "--sni", "-s", metavar="HOSTNAME", - help="Fake SNI hostname (default: auth.vercel.com)", + help="Fake SNI hostname (default: vercel.com)", ) # Bypass settings @@ -372,7 +372,7 @@ def main(): config["LISTEN_PORT"] = port if args.connect: - host, port = parse_host_port(args.connect, "188.114.98.0", 443) + host, port = parse_host_port(args.connect, "5.10.249.0", 443) config["CONNECT_IP"] = host config["CONNECT_PORT"] = port @@ -410,7 +410,7 @@ def main(): # Try to start raw injector (Linux + root only) raw_injector = None use_raw = not getattr(args, 'no_raw', False) - method = config.get("BYPASS_METHOD", "fragment").lower() + method = config.get("BYPASS_METHOD", "fake_sni").lower() if use_raw and method in ("fake_sni", "combined") and interface_ip: if is_raw_available(): diff --git a/tests/test_tls.py b/tests/test_tls.py index 2aa552a..2b50ed2 100644 --- a/tests/test_tls.py +++ b/tests/test_tls.py @@ -41,7 +41,7 @@ class TestClientHelloBuilder(unittest.TestCase): def test_build_client_hello_contains_sni(self): """Test that built ClientHello contains the specified SNI.""" - sni = "auth.vercel.com" + sni = "vercel.com" hello = ClientHelloBuilder.build_client_hello(sni=sni) # The SNI should be present in the packet @@ -72,7 +72,7 @@ class TestClientHelloBuilder(unittest.TestCase): def test_parse_client_hello_roundtrip(self): """Test build and parse roundtrip.""" - sni = "auth.vercel.com" + sni = "vercel.com" hello = ClientHelloBuilder.build_client_hello(sni=sni) parsed = ClientHelloBuilder.parse_client_hello(hello)