I haven't posted in a while, but today I have something interesting to share. Recently, multiple service providers that I use have started blocking some websites using deep packet inspection firewalls. Earlier, these firewalls would only block traffic by examining hostname in GET requests (which is easy to bypass by just using the https version of the target website), but now they employ some more techniques. Specifically, they block based on the SNI field of the TLS client hello, and sometimes also block on the basis of DNS queries. I was looking for ways to bypass these using custom extensions on my browser, but found out that it'll be a very non-trivial problem. Then I looked around and found that- * Latest firefox Nightly builds (and maybe even mainline firefox) have support for DNS over HTTPS (so no DNS based blocking) * Firefox has implemented the ESNI feature discussed in the drafts of TLS 1.3 (again, only available in Nightly build so far) * Cloudflare has enabled ESNI. I won't retell the whole tale, here are quick links-Firefox - https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/Cloudflare - https://blog.cloudflare.com/encrypted-sni The first link also has detailed steps on how to enable these features (plus explanation of what's actually happening). I'll surmise them quickly- 0. Get firefox nightly 1. Type about:config on the url bar.2. Search for network.trr, change network.trr.mode to 23. Search for network.security.esni.enabled and set it to true In all likelihood, your ISP/institution/etc will now not be able to block any website on cloudflare (a LOT of websites use cloudflare), as long as you use firefox nightly. With increased adoption of ESNI, more websites will be able to evade blocking. (These steps won't work if you are in a workplace and the employer has installed his own certificate on the machines and uses a ssl proxy in conjunction with the firewall)

MenuHomeInstall Kali? Really Nice Guide: Must read? Okayish guides: May not read xD?? Install Kali in VMWare?? USB Install (Kali Installation is not our speciality, read up multiple website and watch youtube videos for installation. Come back here for hacking tutorials though, because we are good at those)?? Dual Boot (Kali Installation is not our speciality, and you should refer to many sources to avoid doing a bad install and losing data on your primary OS)?? Kali ResourcesHack With Kali? Wifi Hacking?? Wireless Hacking Basics - Nice theory post you can read whenever you like, posts below should be read in top to bottom order though?? Hack Your Easy First Wifi -Hack WEP : Naive method?? Hack Your Easy First Wifi Again - Hack WEP : Faster, smarter and more complicated method (ARP replay)?? Hack Your Tough Second Wifi - Use reaver : Hack WPA 'with WPS'?? Hack your first two wifis again - Using Wifite : Wireless hacking automation tool?? Start Hacking Your really really tough third wifi - Capture WPA/WPA2 handshake?? Finish Hacking your really really tough third wifi - Crack WPA/WPA2 with Dictionary Attack?? Kick users out of their own network and make them connect to your fake one : Evil Twin Attack?? Cheating your way into hacking that third wifi again - Fluxion : A mix of Evil Twin + Phishing? Website Hacking?? SQL Injection Basics - Quite a short post, would be helpful for the below one - Posts below should be read in top to bottom order?? Hacking Your First Easy Website - Manual SQL Injection (Kali Linux not required, just a browser)?? Hacking Your First Easy Website Again - This time using SqlMap tool (Kali required)?? Blind SQLi  (just below) is a bit complicated, so this post has some boring but useful theory?? Hacking Your tough second website : Blind SQL Injection (attack is as dope as it's name)?? Bonus : Use TOR to obscure your identity while using SQLMap?? A very nice and useful tutorial with no hacking but amazing explanation about DOS attacks?? A nice (but not very nice) tutorial about some specifics of DOS attacks? Penetration Testing?? Hacking Your First Easy OS - Unpatched Windows XP?? Having fun after hacking your first easy OS - Lot of stuff one can do once they are in, some things covered in the tutorial?? Crashing (not hacking) Your Not-so-easy Second OS - Windows 7?? Hacking your first easy OS again : Hollywood Style Hack this time?? A little detour from the script kiddie route: Let's get ourselves some new exploits from Exploit-DB:) ?? Hacking Your third OS - Android (also, meet a new friend, msfvenon)?? Hacking (or at least trying to hack) Your fourth OS - Windows 8 : Using vulnerability present in Java?? Intro to your fifth OS - Metasploitable 2 : This was literally made to be hacked?? Hacking Your fifth OS - Metasploitable 2 : I cover a few vulnerabilites in the OS, after that you should explore further yourself?? Encrypting Your Payloads so that antiviruses don't raise hell - Bypassing AV detection using Veil Evasion? Bonus?? How not to hack Facebook - This post would help you realize that 'actually hacking' Facebook is basically impossible?? How to hack Facebook accounts over LAN: While we can't hack FB, we can do phishing using credentials harvestor (SET) on Kali?? How to hack Facebook accounts over the internet : Extend the above method to work over the internet using port-forwardingVideo tutorials

Bypassing website blocking/censorship with Secure DNS and Encrypted SNI (cloudflare only)

By  Shashwat  December 06, 2018 

• Disclaimer - TLDR; some stuff here can be used to carry out illegal activity, our intention is, however, to educate

I haven't posted in a while, but today I have something interesting to share. Recently, multiple service providers that I use have started blocking some websites using deep packet inspection firewalls. Earlier, these firewalls would only block traffic by examining hostname in GET requests (which is easy to bypass by just using the https version of the target website), but now they employ some more techniques. Specifically, they block based on the SNI field of the TLS client hello, and sometimes also block on the basis of DNS queries. I was looking for ways to bypass these using custom extensions on my browser, but found out that it'll be a very non-trivial problem. Then I looked around and found that-

1. Latest firefox Nightly builds (and maybe even mainline firefox) have support for DNS over HTTPS (so no DNS based blocking)
2. Firefox has implemented the ESNI feature discussed in the drafts of TLS 1.3 (again, only available in Nightly build so far)
3. Cloudflare has enabled ESNI.

I won't retell the whole tale, here are quick links-

Firefox - https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/

Cloudflare - https://blog.cloudflare.com/encrypted-sni

The first link also has detailed steps on how to enable these features (plus explanation of what's actually happening). I'll surmise them quickly-

0. Get firefox nightly
1. Type about:config on the url bar.

2. Search for network.trr, change network.trr.mode to 2

3. Search for network.security.esni.enabled and set it to true

In all likelihood, your ISP/institution/etc will now not be able to block any website on cloudflare (a LOT of websites use cloudflare), as long as you use firefox nightly. With increased adoption of ESNI, more websites will be able to evade blocking.

(These steps won't work if you are in a workplace and the employer has installed his own certificate on the machines and uses a ssl proxy in conjunction with the firewall)

Search This Blog

Popular Posts

• Tutorial on Hacking With Kali Linux
• Evil Twin Tutorial
• How to hack facebook using kali linux : CREDENTIALS HARVESTER ATTACK
• Hacking WPA/WPA2 without dictionary/bruteforce : Fluxion
• SQL Injection Intermediate Level
• Hacking Website with Sqlmap in Kali Linux
• Hack WPA/WPA2 WPS - Reaver - Kali Linux
• Add new exploits to Metasploit from Exploit-db
• Hack WPA/WPA2 PSK Capturing the Handshake
• Things You Should Know : Wireless Hacking Basics

Advertisement

Follow By Email

Facebook

Contact

You can write to us at admin@kalitutorials.net

© Kali Tutorials, 2016. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Shashwat Chaudhary and Kali Tutorials with appropriate and specific direction to the original content.

Bitcoin: 1B5aLqJcMW7zznffTxQwta8JTZsxBDPguC