Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
miyurudassanayake authored Apr 19, 2023
1 parent a05066c commit 578c40c
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
[***Server Name Indication (SNI)***](https://en.wikipedia.org/wiki/Server_Name_Indication) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.This allows a server to present one of multiple possible certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate [<sup>Read more</sup>](https://en.wikipedia.org/wiki/Server_Name_Indication)

Here's a screenshot of **Wireshark** while I'm attempting to connect to zoom.us via https.
<img src="https://github.com/miyurudassanayake/sni-injector/blob/main/static/wireshark.png" width="70%"><br>
<img src="https://github.com/miyurudassanayake/sni-injector/blob/master/static/wireshark.png" width="70%"><br>
As you can see, I applied the <code>ssl.handshake.extensions server name=zoom.us</code> filter to wireshark to filter ssl handshakes where sni is <code>zoom.us</code>.

### What is SNI BUG Host
Expand All @@ -25,12 +25,12 @@ If you have a subscription to <code>zoom.us</code> and want to visit Zoom, your
What if we can modify our SNI and gain access to different sites? Yes! we can. However, SNI verification will fail, and the connection will be terminated by host. But we still can use ***our own TLS connection(with changed SNI) and use a proxy through it access the internet.***

*Here's a simple diagram showing how it's done.*<br>
<img src="https://github.com/miyurudassanayake/sni-injector/blob/main/static/zoom.us.png" width=50%>
<img src="https://github.com/miyurudassanayake/sni-injector/blob/master/static/zoom.us.png" width=50%>

### And here's how is it done

To do so, we need to install a proxy on our server and enable TLS encryption. We can use an SSH tunnel to access a proxy that is already installed on the server. And stunnel can be used to add TLS encryption to that connection.
<img src="https://github.com/miyurudassanayake/sni-injector/blob/main/static/stunnel.png" width="80%">
<img src="https://github.com/miyurudassanayake/sni-injector/blob/master/static/stunnel.png" width="80%">

# Installation

Expand Down

0 comments on commit 578c40c

Please sign in to comment.