There are several countries in our progressive world that apply filtering rules defined by the state — implementing censorship.
As I can suppose, ISPs are blocking websites by their IPs. Just because they can’t see the URL inside the packet — it is behind the SSL/TLS.
But there is an another way of detection — SNI. It is just an optional extension, but it’s now commonly used and is sent in plaintext, so we can analyze it.
So what if we sniff the packet before sending and remove or change its SNI value to some allowed server?
If this substitution going to be detected by the server as MITM and my request will be dropped? Does it affect the checksum or some other authenticity parameters?
Continue reading Can SNI faking be useful for bypassing web filters?→