chatnest.ir/SNISPF
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

change

Browse Source
This commit is contained in:
nouri_a
2026-04-16 14:15:33 +03:30
parent 1bad6394d1
commit d3486c0458
4 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18 -18
View File
@@ -143,7 +143,7 @@ docker run --rm -p 40443:40443 snispf
The simplest way to start -- using the default settings: The simplest way to start -- using the default settings:
```bash ```bash
snispf -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com snispf -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com
``` ```
What each part means: What each part means:
@@ -151,8 +151,8 @@ What each part means:
| Flag | What it does | Example value | | Flag | What it does | Example value |
|---|---|---| |---|---|---|
| `-l` | The local address and port SNISPF listens on | `0.0.0.0:40443` (all interfaces, port 40443) | | `-l` | The local address and port SNISPF listens on | `0.0.0.0:40443` (all interfaces, port 40443) |
| `-c` | The real server IP and port to forward traffic to | `188.114.98.0:443` (a Cloudflare IP) | | `-c` | The real server IP and port to forward traffic to | `5.10.249.0:443` (a Cloudflare IP) |
| `-s` | The fake website name to show the firewall | `auth.vercel.com` (an allowed domain) | | `-s` | The fake website name to show the firewall | `vercel.com` (an allowed domain) |
> **Tip:** If you're not sure what IP or fake SNI to use, the defaults above work for many Cloudflare-based setups. > **Tip:** If you're not sure what IP or fake SNI to use, the defaults above work for many Cloudflare-based setups.
@@ -191,13 +191,13 @@ snispf --config config.json
```bash ```bash
# Basic usage # Basic usage
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com snispf -l :40443 -c 5.10.249.0:443 -s vercel.com
# Use the strongest bypass method # Use the strongest bypass method
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# See verbose debug output # See verbose debug output
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -v snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -v
# Check what your system supports # Check what your system supports
snispf --info snispf --info
@@ -211,9 +211,9 @@ Here's what each field in `config.json` does:
{ {
"LISTEN_HOST": "0.0.0.0", "LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443, "LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0", "CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443, "CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com", "FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment", "BYPASS_METHOD": "fragment",
"FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1, "FRAGMENT_DELAY": 0.1,
@@ -226,9 +226,9 @@ Here's what each field in `config.json` does:
|---|---|---| |---|---|---|
| `LISTEN_HOST` | IP address to listen on. `0.0.0.0` means all network interfaces. | `0.0.0.0` | | `LISTEN_HOST` | IP address to listen on. `0.0.0.0` means all network interfaces. | `0.0.0.0` |
| `LISTEN_PORT` | Port number to listen on locally. | `40443` | | `LISTEN_PORT` | Port number to listen on locally. | `40443` |
| `CONNECT_IP` | The real server's IP address to forward traffic to. | `188.114.98.0` | | `CONNECT_IP` | The real server's IP address to forward traffic to. | `5.10.249.0` |
| `CONNECT_PORT` | The real server's port. | `443` | | `CONNECT_PORT` | The real server's port. | `443` |
| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `auth.vercel.com` | | `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `vercel.com` |
| `BYPASS_METHOD` | Which bypass technique to use: `fragment`, `fake_sni`, or `combined`. | `fragment` | | `BYPASS_METHOD` | Which bypass technique to use: `fragment`, `fake_sni`, or `combined`. | `fragment` |
| `FRAGMENT_STRATEGY` | How to split the hello message: `sni_split`, `half`, `multi`, or `tls_record_frag`. | `sni_split` | | `FRAGMENT_STRATEGY` | How to split the hello message: `sni_split`, `half`, `multi`, or `tls_record_frag`. | `sni_split` |
| `FRAGMENT_DELAY` | How long to wait between sending fragments (in seconds). | `0.1` | | `FRAGMENT_DELAY` | How long to wait between sending fragments (in seconds). | `0.1` |
@@ -308,10 +308,10 @@ Uses both methods at the same time: injects a fake hello (if root is available),
**Without root:** Fragments only (the fake injection is skipped since it can't be done safely without raw sockets). **Without root:** Fragments only (the fake injection is skipped since it can't be done safely without raw sockets).
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# On Linux, run with sudo for the full seq_id trick: # On Linux, run with sudo for the full seq_id trick:
sudo snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined sudo snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
``` ```
--- ---
@@ -330,7 +330,7 @@ These control *how* the hello message gets split up (used by `fragment` and `com
Example: Example:
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
``` ```
--- ---
@@ -373,22 +373,22 @@ Try these steps in order:
1. **Switch bypass method:** `fragment` -> `combined` -> `fake_sni` 1. **Switch bypass method:** `fragment` -> `combined` -> `fake_sni`
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
``` ```
2. **Try different fragment strategies:** `sni_split` -> `multi` -> `tls_record_frag` 2. **Try different fragment strategies:** `sni_split` -> `multi` -> `tls_record_frag`
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
``` ```
3. **Increase the delay between fragments:** 3. **Increase the delay between fragments:**
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-delay 0.2 snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-delay 0.2
``` ```
4. **Try a different fake SNI.** Pick a major website that's not blocked in your area: 4. **Try a different fake SNI.** Pick a major website that's not blocked in your area:
```bash ```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com
``` ```
5. **Double-check the target IP and port.** Make sure `CONNECT_IP` actually points to the server you want. 5. **Double-check the target IP and port.** Make sure `CONNECT_IP` actually points to the server you want.
@@ -407,7 +407,7 @@ On Linux, consider using `combined` or `fake_sni` with `sudo` instead. The raw i
On Linux, run as root. This enables raw packet injection which is the same technique as the original [patterniha tool](https://github.com/patterniha/SNI-Spoofing): On Linux, run as root. This enables raw packet injection which is the same technique as the original [patterniha tool](https://github.com/patterniha/SNI-Spoofing):
```bash ```bash
sudo snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined sudo snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
``` ```
### How do I check what my system supports? ### How do I check what my system supports?
config.json
+2 -2
View File
@@ -1,9 +1,9 @@
{ {
"LISTEN_HOST": "0.0.0.0", "LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443, "LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0", "CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443, "CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com", "FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment", "BYPASS_METHOD": "fragment",
"FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1, "FRAGMENT_DELAY": 0.1,
sni_spoofing/cli.py
+14 -14
View File
@@ -6,7 +6,7 @@ On Linux with root, enables raw packet injection for the seq_id trick.
Usage: Usage:
snispf --config config.json snispf --config config.json
snispf --listen 0.0.0.0:40443 --connect 188.114.98.0:443 --sni auth.vercel.com snispf --listen 0.0.0.0:40443 --connect 5.10.249.0:443 --sni vercel.com
""" """
import argparse import argparse
@@ -90,10 +90,10 @@ def setup_logging(verbose: bool = False, quiet: bool = False):
DEFAULT_CONFIG = { DEFAULT_CONFIG = {
"LISTEN_HOST": "0.0.0.0", "LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443, "LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0", "CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443, "CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com", "FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment", "BYPASS_METHOD": "fake_sni",
"FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1, "FRAGMENT_DELAY": 0.1,
"USE_TTL_TRICK": False, "USE_TTL_TRICK": False,
@@ -124,10 +124,10 @@ def generate_config(output_path: str):
config = { config = {
"LISTEN_HOST": "0.0.0.0", "LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443, "LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0", "CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443, "CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com", "FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment", "BYPASS_METHOD": "fake_sni",
"FRAGMENT_STRATEGY": "sni_split", "FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1, "FRAGMENT_DELAY": 0.1,
"USE_TTL_TRICK": False, "USE_TTL_TRICK": False,
@@ -152,7 +152,7 @@ def build_strategy(config: dict, raw_injector=None) -> BypassStrategy:
for the seq_id trick; falls back to fragmentation without them) for the seq_id trick; falls back to fragmentation without them)
- "combined": Both fragmentation and fake SNI (recommended) - "combined": Both fragmentation and fake SNI (recommended)
""" """
method = config.get("BYPASS_METHOD", "fragment").lower() method = config.get("BYPASS_METHOD", "fake_sni").lower()
if method == "fragment": if method == "fragment":
return FragmentBypass( return FragmentBypass(
@@ -192,8 +192,8 @@ def parse_args():
epilog=( epilog=(
"Examples:\n" "Examples:\n"
" %(prog)s --config config.json\n" " %(prog)s --config config.json\n"
" %(prog)s -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com\n" " %(prog)s -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com\n"
" %(prog)s -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined\n" " %(prog)s -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined\n"
" %(prog)s --generate-config my_config.json\n" " %(prog)s --generate-config my_config.json\n"
"\nBypass Methods:\n" "\nBypass Methods:\n"
" fragment - Fragment TLS ClientHello at SNI boundary (default)\n" " fragment - Fragment TLS ClientHello at SNI boundary (default)\n"
@@ -228,12 +228,12 @@ def parse_args():
parser.add_argument( parser.add_argument(
"--connect", "-c", "--connect", "-c",
metavar="IP:PORT", metavar="IP:PORT",
help="Target server address (default: 188.114.98.0:443)", help="Target server address (default: 5.10.249.0:443)",
) )
parser.add_argument( parser.add_argument(
"--sni", "-s", "--sni", "-s",
metavar="HOSTNAME", metavar="HOSTNAME",
help="Fake SNI hostname (default: auth.vercel.com)", help="Fake SNI hostname (default: vercel.com)",
) )
# Bypass settings # Bypass settings
@@ -372,7 +372,7 @@ def main():
config["LISTEN_PORT"] = port config["LISTEN_PORT"] = port
if args.connect: if args.connect:
host, port = parse_host_port(args.connect, "188.114.98.0", 443) host, port = parse_host_port(args.connect, "5.10.249.0", 443)
config["CONNECT_IP"] = host config["CONNECT_IP"] = host
config["CONNECT_PORT"] = port config["CONNECT_PORT"] = port
@@ -410,7 +410,7 @@ def main():
# Try to start raw injector (Linux + root only) # Try to start raw injector (Linux + root only)
raw_injector = None raw_injector = None
use_raw = not getattr(args, 'no_raw', False) use_raw = not getattr(args, 'no_raw', False)
method = config.get("BYPASS_METHOD", "fragment").lower() method = config.get("BYPASS_METHOD", "fake_sni").lower()
if use_raw and method in ("fake_sni", "combined") and interface_ip: if use_raw and method in ("fake_sni", "combined") and interface_ip:
if is_raw_available(): if is_raw_available():
tests/test_tls.py
+2 -2
View File
@@ -41,7 +41,7 @@ class TestClientHelloBuilder(unittest.TestCase):
def test_build_client_hello_contains_sni(self): def test_build_client_hello_contains_sni(self):
"""Test that built ClientHello contains the specified SNI.""" """Test that built ClientHello contains the specified SNI."""
sni = "auth.vercel.com" sni = "vercel.com"
hello = ClientHelloBuilder.build_client_hello(sni=sni) hello = ClientHelloBuilder.build_client_hello(sni=sni)
# The SNI should be present in the packet # The SNI should be present in the packet
@@ -72,7 +72,7 @@ class TestClientHelloBuilder(unittest.TestCase):
def test_parse_client_hello_roundtrip(self): def test_parse_client_hello_roundtrip(self):
"""Test build and parse roundtrip.""" """Test build and parse roundtrip."""
sni = "auth.vercel.com" sni = "vercel.com"
hello = ClientHelloBuilder.build_client_hello(sni=sni) hello = ClientHelloBuilder.build_client_hello(sni=sni)
parsed = ClientHelloBuilder.parse_client_hello(hello) parsed = ClientHelloBuilder.parse_client_hello(hello)