The latest articles on DEV Community by Sadegh Hayeri (@sadeghhayeri). https://dev.to/sadeghhayeri https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F361986%2F44672986-045e-4ab1-bd00-9e67e4bb218c.jpeg https://dev.to/sadeghhayeri en Sadegh Hayeri Mon, 06 Apr 2020 20:30:55 +0000 https://dev.to/sadeghhayeri/greentunnel-is-an-anti-censorship-utility-designed-to-bypass-the-dpi-systems-pp2 https://dev.to/sadeghhayeri/greentunnel-is-an-anti-censorship-utility-designed-to-bypass-the-dpi-systems-pp2 <p>GreenTunnel bypasses DPI (Deep Packet Inspection) systems without changing IP or server endpoints. (Linux, macOS, and Windows + docker)</p> <p>The entire project is open source and you can check out the source code on my <a href="https://github.com/SadeghHayeri/GreenTunnel">sadeghhayeri/greentunnel</a> repo.</p> <h4> How does it work? </h4> <p>There are gaps in providers in DPI. They happen from what the DPI rules write for ordinary user programs, omitting all possible cases that are permissible by standards. This is done for simplicity and speed.<br> Some DPIs cannot recognize the HTTP request if it is divided into TCP segments. For example, a request of the form</p> <p><code>GET / HTTP/1.0<br> Host: www.youtube.com<br> ...</code></p> <p>we send it in 2 parts: first comes <code>GET / HTTP/1.0 \n Host: www.you</code> and second sends as <code>tube.com \n ...</code>. In this example, ISP cannot find blocked word <strong>youtube</strong> in packets and you can bypass it!</p> <p>Or for HTTPS, Server Name Indication (SNI) is an extension to TLS (Transport Layer Security) that indicates the actual destination hostname a client is attempting to access over HTTPS. For this Web Filter feature, SNI hostname information is used for blocking access to specific sites over HTTPS. For example, if the administrator chooses to block the hostname <strong>youtube</strong> using this feature, all Website access attempts over HTTPS that contain <strong>youtube</strong> like <strong><a href="http://www.youtube.com">www.youtube.com</a></strong> in the SNI would be blocked. However, access to the same hostname over HTTP would not be blocked by this feature. GreenTunnel tries to split first <strong>CLIENT-HELLO</strong> packet into small chunks and ISPs can't parse packet and found SNI field so bypass traffic!</p> <p>We'd love to hear what you think about GreenTunnel, ideas for improvement, and features you want to see! Please, don't hesitate to open an issue.</p> opensource node security github