Monday, August 12, 2024

Setting Up and Using SpoofDPI

Brief description Firefox Proxy setup to work via SpoofDPI daemon been started in terminal session. Tested on Arch Linux and Fedora 40 WKS . Per https://github.com/xvzc/SpoofDPI

HTTPS  (CASE)

Although TLS encrypts every handshake process, the domain names are still shown as plaintext in the Client hello packet. In other words, when someone else looks on the packet, they can easily guess where the packet is headed to. The domain name can offer a significant information while DPI is being processed, and we can actually see that the connection is blocked right after sending Client hello packet. "XVZC" had tried some ways to bypass this, and found out that it seemed like only the first chunk gets inspected when we send the Client hello packet splited in chunks. What SpoofDPI does to bypass this is to send the first 1 byte of a request to the server, and then send the rest.

See also https://innovirtuoso.com/blog/introducing-spoofdpi-bypassing-deep-packet-inspection-through-a-github-repository/#introducing-spoofdpi-a-solution-to-bypass-dpi


SpoofDPI will be installed in ~/.spoof-dpi/bin. To run SpoofDPI in any directory, add the line below to your ~/.bashrc || ~/.zshrc || ...

export PATH=$PATH:~/.spoof-dpi/bin

# macOS Intel
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s darwin-amd64

# macOS Apple Silicon
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s darwin-arm64

# linux-amd64
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s linux-amd64

# linux-arm
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s linux-arm

# linux-arm64
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s linux-arm64

# linux-mips
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s linux-mips

# linux-mipsle
curl -fsSL https://raw.githubusercontent.com/xvzc/SpoofDPI/main/install.sh | bash -s linux-mipsle

Go

You can also install SpoofDPI with go install

$ go install github.com/xvzc/SpoofDPI/cmd/spoof-dpi@latest

Git

You can also build your own

$ git clone https://github.com/xvzc/SpoofDPI.git
$ cd SpoofDPI
$ go build ./cmd/...

Usage

Usage: spoof-dpi [options...]
  -addr string
        listen address (default "127.0.0.1")
  -debug
        enable debug output
  -dns-addr string
        dns address (default "8.8.8.8")
  -dns-port int
        port number for dns (default 53)
  -enable-doh
        enable 'dns-over-https'
  -no-banner
        disable banner
  -pattern value
        bypass DPI only on packets matching this regex pattern; can be given multiple times
  -port int
        port (default 8080)
  -system-proxy
        enable system-wide proxy (default true)
  -timeout int
        timeout in milliseconds; no timeout when not given
  -v    print spoof-dpi's version; this may contain some other relevant information
  -window-size int
        chunk size, in number of bytes, for fragmented client hello,
        try lower values if the default value doesn't bypass the DPI;
        when not given, the client hello packet will be sent in two parts:
        fragmentation for the first data packet and the rest

If you are using any vpn extensions such as Hotspot Shield in Chrome browser, go to Settings > Extensions, and disable them.

OSX

Run spoof-dpi and it will automatically set your proxy

Linux

Run spoof-dpi and open your favorite browser with proxy option

google-chrome --proxy-server="http://127.0.0.1:8080"

Through these steps, users can strategically set up and utilize SpoofDPI, harnessing its potential to navigate networks monitored by DPI technology effortlessly.

First run

> ~/.spoofdpi/bin/spoofdpi &!

Second

Firefox HTTPS proxy should be tuned this way to put SpoofDPI in work


















Configuration SpoofDPI as service

boris@fedora:~$ systemctl --user status spoofdpi.service

● spoofdpi.service - Script Daemon For Test User Services

     Loaded: loaded (/etc/xdg/systemd/user/spoofdpi.service; enabled; preset: disabled)

    Drop-In: /usr/lib/systemd/user/service.d

             └─10-timeout-abort.conf

     Active: active (running) since Thu 2024-08-15 12:49:22 UTC; 19s ago

   Main PID: 2455 (spoof-dpi)

      Tasks: 8 (limit: 38308)

     Memory: 8.3M (peak: 9.4M)

        CPU: 13ms

     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/spoofdpi.service

             └─2455 /home/boris/.spoofdpi/bin/spoofdpi


Aug 15 12:49:22 fedora systemd[2419]: Started spoofdpi.service - Script Daemon For Test User Ser>

boris@fedora:~$ netstat -antp|grep 8080

(Not all processes could be identified, non-owned process info

 will not be shown, you would have to be root to see it all.)

tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      2455/spoof-dpi      

boris@fedora:~$ cat spoofdpi.service

[Unit]

Description=Script Daemon For Test User Services

[Service]

Type=simple

#User=

#Group=

ExecStart=/home/boris/.spoofdpi/bin/spoofdpi

Restart=on-failure

StandardOutput=file:%h/log_file

[Install]

WantedBy=default.target

Next step:

$ sudo cp spoofdpi.service  /etc/systemd/user/

systemctl --user daemon-reload

systemctl --user start spoofdpi.service

$ systemctl --user enable spoofdpi.service


~$ netstat -antp | grep 8080
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      10225/spoof-dpi     
tcp        0      0 127.0.0.1:8080          127.0.0.1:36142         ESTABLISHED 10225/spoof-dpi     
tcp        0      0 127.0.0.1:47444         127.0.0.1:8080          ESTABLISHED 3772/firefox        
tcp        0      0 127.0.0.1:44516         127.0.0.1:8080          ESTABLISHED 3772/firefox        
tcp        0      0 127.0.0.1:36142         127.0.0.1:8080          ESTABLISHED 3772/firefox        
tcp        0      0 127.0.0.1:51218         127.0.0.1:8080          TIME_WAIT   -                   
tcp        0      0 127.0.0.1:51936         127.0.0.1:8080          ESTABLISHED 3772/firefox        
tcp        0      0 127.0.0.1:8080          127.0.0.1:49382         ESTABLISHED 10225/spoof-dpi     
tcp        0      0 127.0.0.1:8080          127.0.0.1:47444         ESTABLISHED 10225/spoof-dpi     
tcp        0      0 127.0.0.1:8080          127.0.0.1:51936         ESTABLISHED 10225/spoof-dpi     
tcp        0      0 127.0.0.1:49382         127.0.0.1:8080          ESTABLISHED 3772/firefox        
tcp        0      0 127.0.0.1:8080          127.0.0.1:44516         ESTABLISHED 10225/spoof-dpi  
   
*******************************
UPDATE as of 09/08/24
********************
 Also notice that Gnome DE allows to setup system wide  Network HTTPS Proxy along with spoofdpi.service. It provides an option to avoid tuning proxy setup inside Web Browsers



































No comments:

Post a Comment