{"id":53317,"date":"2019-11-29T00:00:00","date_gmt":"2019-11-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3-chast-2"},"modified":"2020-02-18T14:01:12","modified_gmt":"2020-02-18T11:01:12","slug":"domen-fronting-na-baze-tls-1-3-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","title":{"rendered":"Domen-fronting mbi baz\u00ebn e TLS 1.3. Pjesa 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hyrje<\/h3>\n

\nN\u00eb pjes\u00ebn e par\u00eb artikullit<\/a><\/noindex> ne dham\u00eb nj\u00eb p\u00ebrshkrim t\u00eb shpejt\u00eb t\u00eb mekanizmit t\u00eb SNI t\u00eb enkriptuar (eSNI). Treguam si mund t\u00eb shmanget detektimi nga sistemet moderne DPI (n\u00eb shembullin e DPI t\u00eb Beeline dhe RTK-n\u00eb e ndaluar t\u00eb RuTracker), si dhe shqyrtuam nj\u00eb variant t\u00eb ri t\u00eb fronting t\u00eb domainit n\u00eb baz\u00eb t\u00eb k\u00ebtij mekanizmi.<\/p>\n

N\u00eb pjes\u00ebn e dyt\u00eb t\u00eb artikullit do t\u00eb kalojm\u00eb n\u00eb \u00e7\u00ebshtje m\u00eb praktike q\u00eb do t\u00eb jen\u00eb t\u00eb dobishme p\u00ebr specialist\u00ebt e RedTeam n\u00eb pun\u00ebn e tyre t\u00eb v\u00ebshtir\u00eb. Pas gjith\u00eb k\u00ebsaj, q\u00ebllimi yn\u00eb nuk \u00ebsht\u00eb t\u00eb fitojm\u00eb qasje n\u00eb burime t\u00eb bllokuara (p\u00ebr gj\u00ebra t\u00eb tilla banale kemi VPN-in e vjet\u00ebr dhe t\u00eb mir\u00eb). Fatmir\u00ebsisht, ekzistojn\u00eb shum\u00eb ofrues VPN, si\u00e7 thuhet, p\u00ebr \u00e7do shije, ngjyr\u00eb dhe buxhet.<\/p>\n

Ne do t\u00eb p\u00ebrpiqemi t\u00eb aplikojm\u00eb mekanizmin e fronting t\u00eb domainit p\u00ebr mjetet moderne t\u00eb RedTeam, si\u00e7 jan\u00eb Cobalt Strike, Empire etj., dhe t'u japim atyre mund\u00ebsi shtes\u00eb p\u00ebr mimikrim dhe shmangie nga sistemet moderne t\u00eb filtrimit t\u00eb p\u00ebrmbajtjes.
\n<\/a><\/noindex>
\nHer\u00ebn e fundit, ne implementuam mekanizmin e eSNI n\u00eb bibliotek\u00ebn OpenSSL dhe e p\u00ebrdor\u00ebm me sukses n\u00eb utilitarin e njohur curl. Por me nj\u00eb curl, si\u00e7 thuhet, nuk do t\u00eb ngopesh. Sigurisht, d\u00ebshirojm\u00eb t\u00eb realizojm\u00eb di\u00e7ka t\u00eb ngjashme n\u00eb gjuh\u00eb t\u00eb nivelit t\u00eb lart\u00eb. Por, fatkeq\u00ebsisht, k\u00ebrkimi i shpejt\u00eb n\u00eb hap\u00ebsir\u00ebn e internetit na zhg\u00ebnjen, sepse mb\u00ebshtetje p\u00ebr mekanizmin e eSNI \u00ebsht\u00eb implementuar plot\u00ebsisht vet\u00ebm n\u00eb GOLANG. k\u00ebshtu q\u00eb zgjedhja jon\u00eb nuk \u00ebsht\u00eb shum\u00eb e madhe: ose shkruajm\u00eb n\u00eb C ose C++ t\u00eb past\u00ebr duke p\u00ebrdorur bibliotek\u00ebn e pat\u00e7izuar OpenSSL, ose p\u00ebrdorim nj\u00eb fork t\u00eb ve\u00e7ant\u00eb GOLANG nga CloudFlare dhe p\u00ebrpiqemi t\u00eb portojm\u00eb mjetet tona atje. N\u00eb parim, ka edhe nj\u00eb variant tjet\u00ebr, m\u00eb klasik, por nj\u00ebkoh\u00ebsisht edhe pune e madhe \u2013 \u00ebsht\u00eb t\u00eb realizojm\u00eb mb\u00ebshtetje p\u00ebr eSNI p\u00ebr Python. N\u00eb fund t\u00eb fundit, Python gjithashtu p\u00ebrdor OpenSSL p\u00ebr t\u00eb punuar me https. Por k\u00ebt\u00eb variant do ta l\u00ebm\u00eb p\u00ebr zhvillim p\u00ebr dik\u00eb tjet\u00ebr, nd\u00ebrsa ne do t\u00eb jemi t\u00eb k\u00ebnaqur me realizimin n\u00eb GOLANG, sidomos q\u00eb Cobalt Strike yn\u00eb i dashur e di t\u00eb punoj\u00eb me kanale komunikimi t\u00eb nd\u00ebrtuara nga mjete t\u00eb jashtme (External C2 channel) \u2013 p\u00ebr k\u00ebt\u00eb do t\u00eb flasim n\u00eb fund t\u00eb artikullit.<\/p>\n

Try Harder...<\/h3>\n

\nNj\u00eb nga mjetet e implementuara n\u00eb Go \u2013 zhvillimi yn\u00eb p\u00ebr pivotimin brenda rrjetit \u2013 tunneluesi rsockstun<\/a><\/noindex>, i cili, p\u00ebr t\u00eb th\u00ebn\u00eb t\u00eb v\u00ebrtet\u00ebn, tani detektohet nga mjete nga Microsoft dhe Symantec, si software shum\u00eb t\u00eb d\u00ebmsh\u00ebm, t\u00eb orientuar p\u00ebr t\u00eb prishur stabilitetin global...<\/p>\n

\"Domen-fronting
\n
\nDo t\u00eb ishte mir\u00eb t\u00eb p\u00ebrdorim zhvillimin e m\u00ebparsh\u00ebm edhe n\u00eb k\u00ebt\u00eb rast. Por k\u00ebtu lind nj\u00eb problem i vog\u00ebl. Problemi \u00ebsht\u00eb se fillimisht, rsockstun parashikon p\u00ebrdorimin e nj\u00eb kanali SSL sinkron me serverin. Kjo do t\u00eb thot\u00eb se lidhja vendoset nj\u00eb her\u00eb dhe ekziston gjat\u00eb gjith\u00eb koh\u00ebs s\u00eb pun\u00ebs s\u00eb tunneluesit. Dhe, si\u00e7 mund ta kuptoni, protokolli https nuk \u00ebsht\u00eb shum\u00eb i destinuar p\u00ebr nj\u00eb mod si ky \u2013 ai punon n\u00eb modin k\u00ebrkes\u00eb-p\u00ebrgjigje, ku \u00e7do k\u00ebrkes\u00eb e re http ekziston n\u00eb kuad\u00ebr t\u00eb nj\u00eb lidhjeje t\u00eb re tcp.<\/p>\n

Mang\u00ebsia kryesore e k\u00ebtij skeme \u00ebsht\u00eb se serveri nuk mund t'i d\u00ebrgoj\u00eb t\u00eb dh\u00ebna klientit derisa klienti t\u00eb d\u00ebrgoj\u00eb nj\u00eb k\u00ebrkes\u00eb t\u00eb re http. Por, p\u00ebr fat t\u00eb mir\u00eb, ekzistojn\u00eb shum\u00eb variante zgjidhjeje t\u00eb k\u00ebtij problemi \u2013 transmetimit t\u00eb t\u00eb dh\u00ebnave n\u00ebp\u00ebrmjet protokollit http (n\u00eb fund t\u00eb fundit ne arrijm\u00eb t\u00eb shohim serit\u00eb tona t\u00eb preferuara dhe t\u00eb d\u00ebgjojm\u00eb muzik\u00eb nga portale q\u00eb punojn\u00eb n\u00eb https, dhe transmetimi i videove dhe audios \u00ebsht\u00eb ashtusi si transmetimi i t\u00eb dh\u00ebnave). Nj\u00eb nga teknologjit\u00eb p\u00ebr imitim t\u00eb pun\u00ebs s\u00eb nj\u00eb lidhjeje t\u00eb plot\u00eb tcp mbi protokollin http \u00ebsht\u00eb teknologjia e web-sockets (WebSockets), ku q\u00ebllimi kryesor \u00ebsht\u00eb organizimi i nj\u00eb lidhjeje t\u00eb plot\u00eb rrjet\u00ebsore mes klientit dhe serverit web.<\/p>\n

P\u00ebr fatin ton\u00eb (ura-ura!!!), kjo teknologji \u00ebsht\u00eb e p\u00ebrfshir\u00eb si standard n\u00eb t\u00eb gjitha planet e CloudFlare dhe punon mir\u00eb n\u00eb kombinim me eSNI. Pik\u00ebrisht at\u00ebher\u00eb do ta p\u00ebrdorim p\u00ebr t\u00eb m\u00ebsuar tunneluesin ton\u00eb t\u00eb p\u00ebrdor\u00eb fronting t\u00eb domainit dhe t\u00eb fshihet nga sistemet moderne DPI. <\/p>\n

Pak mbi WebSockets<\/h3>\n

\nN\u00eb radh\u00eb t\u00eb par\u00eb, do t\u00eb flasim pak dhe me fjal\u00eb t\u00eb thjeshta rreth web-sockets, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb gjith\u00eb t\u00eb ken\u00eb nj\u00eb ide t\u00eb asaj me t\u00eb cil\u00ebn do t\u00eb punojm\u00eb. <\/p>\n

Teknologjia e web-sockets lejon q\u00eb p\u00ebrkoh\u00ebsisht t\u00eb kalojm\u00eb nga nj\u00eb lidhje http n\u00eb transmetim standard t\u00eb t\u00eb dh\u00ebnave n\u00ebp\u00ebrmjet nj\u00eb socketi rrjet\u00ebsor, pa e nd\u00ebrprer\u00eb lidhjen tcp t\u00eb vendosur. Kur klienti d\u00ebshiron t\u00eb kaloj\u00eb n\u00eb web-socket, ai vendos disa headers http n\u00eb k\u00ebrkes\u00ebn e tij http. Dy headers t\u00eb domosdosh\u00ebm jan\u00eb Connection: Upgrade<\/b><\/i> dhe Upgrade: websocket<\/b><\/i>. Ai gjithashtu mund t\u00eb tregoj\u00eb versionin e protokollit t\u00eb web-socket (Sec-Websocket-Version: 13<\/b><\/i>) dhe di\u00e7ka t\u00eb till\u00eb si identifikuesi base64 t\u00eb web-socketit (Sec-WebSocket-Key: DAGDJSiREI3+KjDfwxm1FA==<\/b><\/i>). Serveri i p\u00ebrgjigjet me kodin http 101 Switching Protocols dhe gjithashtu vendos headers Connection, Upgrade<\/b><\/i> dhe Sec-WebSocket-Accept<\/b><\/i>. Procesi i kalimit \u00ebsht\u00eb ilustruar m\u00eb posht\u00eb:<\/p>\n

\"Domen-fronting
\n
\nPas k\u00ebsaj, mund t\u00eb themi se vendosja e lidhjes WebSocket \u00ebsht\u00eb p\u00ebrfunduar. T\u00eb dh\u00ebnat nga klienti dhe serveri tani do t\u00eb d\u00ebrgohen me tituj WebSocket (ata fillojn\u00eb me bajtin 0x82). Tani, serveri nuk ka nevoj\u00eb t\u00eb pres\u00eb nj\u00eb k\u00ebrkes\u00eb nga klienti p\u00ebr t\u00eb p\u00ebrcjell\u00eb t\u00eb dh\u00ebna, sepse lidhja tcp nuk nd\u00ebrpritet.<\/p>\n

N\u00eb Golang, ka disa biblioteka p\u00ebr pun\u00ebn me web-socket. Nga m\u00eb t\u00eb njohurit jan\u00eb Gorilla WebSocket<\/a><\/noindex> dhe standardja WebSocket<\/a><\/noindex>. Ne do t\u00eb p\u00ebrdorim k\u00ebt\u00eb t\u00eb fundit, pasi \u00ebsht\u00eb m\u00eb e thjesht\u00eb, m\u00eb e vog\u00ebl dhe funksionon, si\u00e7 thon\u00eb, pak m\u00eb shpejt.<\/p>\n

N\u00eb kodin e klientit rsockstun ne duhet t\u00eb z\u00ebvend\u00ebsojm\u00eb thirrjet net.dial ose tls.dial me thirrjet p\u00ebrkat\u00ebse WebSocket:<\/p>\n

\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nNe duam q\u00eb pjesa klientore e tunelit ton\u00eb t\u00eb jet\u00eb universale dhe e aft\u00eb t\u00eb punoj\u00eb si p\u00ebrmes nj\u00eb lidhjeje t\u00eb thjesht\u00eb ssl, ashtu edhe p\u00ebrmes protokollit WebSocket. P\u00ebr k\u00ebt\u00eb, ne do t\u00eb krijojm\u00eb nj\u00eb funksion t\u00eb ve\u00e7ant\u00eb func connectForWsSocks(address string, proxy string) error {\u2026}<\/b><\/i> sip\u00ebr connectForSocks()<\/b><\/i> dhe do ta p\u00ebrdorim at\u00eb p\u00ebr t\u00eb punuar me web-socket n\u00eb rast se adresa e serverit, e cila \u00ebsht\u00eb vendosur n\u00eb fillim t\u00eb klientit, fillon me ws: ose wss: (n\u00eb rastin e Secure WebSocket).<\/p>\n

P\u00ebr pjes\u00ebn serverore t\u00eb tunelit, ne gjithashtu do t\u00eb krijojm\u00eb nj\u00eb funksion t\u00eb ve\u00e7ant\u00eb p\u00ebr pun\u00ebn me web-socket. N\u00eb t\u00eb do t\u00eb krijohet nj\u00eb instanc\u00eb e klas\u00ebs http dhe do t\u00eb caktosh nj\u00eb trajtues p\u00ebr lidhjen http (funksioni wsHandler): <\/p>\n

\"Domen-fronting
\n
\nDhe t\u00eb gjith\u00eb logjik\u00ebn e trajtimit t\u00eb lidhjes (autorizimi i klientit me fjal\u00ebkalim, vendosja dhe p\u00ebrfundimi i sesionit yamux) do ta vendosim n\u00eb trajtuesin e lidhjes WebSocket:<\/p>\n

\"Domen-fronting
\n
\nKompilo projektin, ekzekuto pjes\u00ebn serverore:<\/p>\n

.\/rsockstun \u2013listen ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nDhe pastaj pjes\u00ebn klientore:<\/p>\n
.\/rsockstun -connect ws:127.0.0.1:8080 \u2013pass P@ssw0rd<\/code><\/pre>\n
\nDhe verifiko funksionimin n\u00eb hostin lokal:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n<\/p>\n
Le t\u00eb kalojm\u00eb te domain-fronting<\/h3>\n
\nMe web-socket duket se kemi mbyllur. Tani le t\u00eb kalojm\u00eb direkt te eSNI dhe domain-fronting. Si\u00e7 u tha m\u00eb par\u00eb, p\u00ebr t\u00eb punuar me DoH dhe eSNI, duhet t\u00eb marrim nj\u00eb deg\u00eb speciale t\u00eb Golang nga kompania CloudFlare<\/a><\/noindex>. Na nevojitet dega me mb\u00ebshtetje p\u00ebr eSNI (pwu\/esni).<\/p>\n
E klonojm\u00eb at\u00eb n\u00eb lokal ose e shkarkojm\u00eb dhe e shpaketojm\u00eb zip-in p\u00ebrkat\u00ebs:<\/p>\n
git clone -b pwu\/esni https:\/\/github.com\/cloudflare\/tls-tris.git<\/code><\/pre>\n
\nPastaj na duhet t\u00eb kopjojm\u00eb katalogun GOROOT, t\u00eb z\u00ebvend\u00ebsojm\u00eb skedar\u00ebt p\u00ebrkat\u00ebs nga dega e klonuar dhe ta vendosim si t\u00eb par\u00eb. P\u00ebr t\u00eb hequr k\u00ebt\u00eb ngarkes\u00eb nga zhvilluesi, djemt\u00eb nga CloudFlare p\u00ebrgatit\u00ebn nj\u00eb skenar t\u00eb ve\u00e7ant\u00eb \u2013 _dev\/go.sh. Thjesht e ekzekutojm\u00eb at\u00eb. Skripti s\u00eb bashku me makefile do t\u00eb kryejn\u00eb gjith\u00e7ka vet\u00eb. P\u00ebr interes, mund t\u00eb shikoni brenda makefile p\u00ebr detaje.<\/p>\n
Pas p\u00ebrfundimit t\u00eb skenarit, gjat\u00eb kompilimit t\u00eb projektit, na nevojitet t\u00eb caktom\u00eb katalogun lokal t\u00eb p\u00ebrgatitur nga skripti si GOROOT. N\u00eb rastin ton\u00eb kjo duket k\u00ebshtu:<\/p>\n
GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" go build \u2026.<\/code><\/pre>\n
\nM\u00eb pas, na duhet t\u00eb realizojm\u00eb n\u00eb tunel funksionalitetin e k\u00ebrkes\u00ebs dhe parsing t\u00eb \u00e7el\u00ebsave publik\u00eb eSNI p\u00ebr domenin n\u00eb fjal\u00eb. N\u00eb rastin ton\u00eb, k\u00ebto do t\u00eb jen\u00eb \u00e7el\u00ebsat publik\u00eb eSNI nga serverat e frontend-it t\u00eb CloudFlare. P\u00ebr k\u00ebt\u00eb, ne do t\u00eb krijojm\u00eb tre funksione:<\/p>\n
func makeDoTQuery(dnsName string) ([]byte, error)\nfunc parseTXTResponse(buf []byte, wantName string) (string, error)\nfunc QueryESNIKeysForHost(hostname string) ([]byte, error)<\/code><\/pre>\n
\nEmrat e funksioneve, n\u00eb parim, flasin vet\u00eb. Ne do t\u00eb marrim mbushjen nga skedari esni_query.go, i cili b\u00ebn pjes\u00eb n\u00eb tls-tris. Funksioni i par\u00eb krijon nj\u00eb paket\u00eb rrjeti me nj\u00eb k\u00ebrkes\u00eb p\u00ebr serverin DNS t\u00eb CloudFlare, duke p\u00ebrdorur protokollin DoH (DNS-over-HTTPS), i dyti \u2013 analizojn\u00eb rezultatet e k\u00ebrkes\u00ebs dhe marrin vlerat e \u00e7el\u00ebsave publik\u00eb t\u00eb domenit, nd\u00ebrsa i treti \u00ebsht\u00eb nj\u00eb kontejner p\u00ebr dy t\u00eb par\u00ebt.<\/p>\n
M\u00eb pas, ne do t\u00eb fusim n\u00eb funksionin ton\u00eb t\u00eb sapo krijuar p\u00ebr lidhjen me web-socket connectForWsSocks<\/b><\/i> funksionalitetin e k\u00ebrkes\u00ebs eSNI p\u00ebr domenin. Atje ku funksionon pjesa serverore, vendosim parametrat TLS, si dhe caktosh emrin e 'domenit' t\u00eb rrem\u00eb:<\/p>\n
\"Domen-fronting
\n
\nK\u00ebtu duhet t\u00eb theksohet se fillimisht, dega tls-tris nuk \u00ebsht\u00eb e projektuar p\u00ebr p\u00ebrdorimin e domain-fronting. Prandaj, n\u00eb t\u00eb nuk i \u00ebsht\u00eb kushtuar v\u00ebmendje emrit t\u00eb rrem\u00eb t\u00eb serverit (n\u00eb paket\u00ebn client-hello d\u00ebrgohet nj\u00eb fush\u00eb e zbraz\u00ebt serverName). P\u00ebr ta korigjuar k\u00ebt\u00eb, do t\u00eb duhet t\u00eb shtojm\u00eb n\u00eb struktur\u00ebn TlsConfig fush\u00ebn p\u00ebrkat\u00ebse FakeServerName. Ne nuk mund ta p\u00ebrdorim fush\u00ebn standarde ServerName t\u00eb struktur\u00ebs, pasi ajo p\u00ebrdoret nga mekanizmat e brendsh\u00ebm t\u00eb tls dhe n\u00ebse do t\u00eb ndryshoj\u00eb nga origjinali, at\u00ebher\u00eb tls-handshake do t\u00eb p\u00ebrfundoj\u00eb me nj\u00eb gabim. P\u00ebrshkrimi i struktur\u00ebs TlsConfig gjendet n\u00eb skedarin tls\/common.go<\/b> \u2013 dhe ne do ta rregullojm\u00eb at\u00eb:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nP\u00ebrve\u00e7 k\u00ebsaj, do t\u00eb duhet t\u00eb b\u00ebjm\u00eb ndryshime n\u00eb skedarin tls\/handshake_client.go<\/b>, p\u00ebr t\u00eb p\u00ebrdorur fush\u00ebn ton\u00eb FakeServerName gjat\u00eb formimit t\u00eb TLS handshake:<\/p>\n
\"Domen-fronting
\n
\nKjo \u00ebsht\u00eb e gjitha! Mund t\u00eb kompiloni projektin dhe t\u00eb kontrolloni funksionimin. Por para se t\u00eb filloni verifikimin, duhet t\u00eb konfiguroni llogarin\u00eb CloudFlare. Si ta themi, thjesht krijoni nj\u00eb llogari n\u00eb CloudFlare dhe lidheni domenin tuaj me t\u00eb. T\u00eb gjitha ve\u00e7orit\u00eb q\u00eb lidhen me DoH, WebSocket dhe ESNI jan\u00eb t\u00eb aktivizuara n\u00eb CloudFlare nga e drejta. Pas p\u00ebrdit\u00ebsimit t\u00eb sh\u00ebnimeve DNS, mund t\u00eb verifikoni funksionimin e domenit duke b\u00ebr\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr \u00e7el\u00ebsat e eSNI:<\/p>\n
dig +short txt _esni.df13tester.info <\/code><\/pre>\n
\n\"Domen-fronting
\n
\nN\u00ebse shihni di\u00e7ka t\u00eb ngjashme p\u00ebr domenin tuaj, at\u00ebher\u00eb gjith\u00e7ka funksionon si\u00e7 duhet dhe mund t\u00eb kaloni n\u00eb testim.<\/p>\n
Lansoni nj\u00eb Ubuntu VPS, p\u00ebr shembull, n\u00eb DigitalOcean. P.S. N\u00eb rastin ton\u00eb, adresa IP e dh\u00ebn\u00eb nga ofruesi doli n\u00eb listat e zeza t\u00eb RKN. Pra, mos u \u00e7udisni n\u00ebse ju ndodh di\u00e7ka e ngjashme. Duhej t\u00eb p\u00ebrdornim nj\u00eb VPN p\u00ebr t\u00eb hyr\u00eb n\u00eb VPS-n\u00eb ton\u00eb.<\/p>\n
Kopjojm\u00eb n\u00eb VPS rsockstun e kompiliuar tashm\u00eb (n\u00eb fakt, kjo \u00ebsht\u00eb nj\u00eb prej p\u00ebrpar\u00ebsive t\u00eb golang \u2013 mund ta kompiloni projektin tuaj k\u00ebtu dhe ta nisni n\u00eb \u00e7do Linux, duke respektuar vet\u00ebm arkitektur\u00ebn e sistemit) dhe nisni pjes\u00ebn server:<\/p>\n
\"Domen-fronting
\n
\nPastaj pjesa klient:<\/p>\n
\"Domen-fronting
\n
\nSi\u00e7 mund ta shohim, klienti u lidh me sukses me serverin p\u00ebrmes serverit front-end t\u00eb CloudFlare duke p\u00ebrdorur websockets. P\u00ebr t\u00eb kontrolluar n\u00ebse tuneli funksionon pik\u00ebrisht si nj\u00eb tunel, mund t\u00eb b\u00ebni nj\u00eb k\u00ebrkes\u00eb curl p\u00ebrmes socks5 lokal, i hapur n\u00eb server:<\/p>\n
\"Domen-fronting
\n
\nTani do t\u00eb shohim se \u00e7far\u00eb sheh DPI n\u00eb kanalin e komunikimit:<\/p>\n
\"Domen-fronting
\n
\nS\u00eb pari, tuneluesi, duke p\u00ebrdorur mekanizmin DoH, i drejtohet serverit DNS t\u00eb Cloudflare p\u00ebr \u00e7el\u00ebsat e eSNI p\u00ebr domenin e destinacionit (paketat \u21161-19), dhe m\u00eb pas kontakton serverin front-end dhe krijon nj\u00eb lidhje TLS, duke u fshehur n\u00ebn domenin www.google.com<\/a><\/noindex> (kjo \u00ebsht\u00eb vlera e paracaktuar, kur p\u00ebrdoruesi nuk specifikon nj\u00eb domen t\u00eb rrem\u00eb gjat\u00eb nisjes s\u00eb klientit). P\u00ebr t\u00eb specifikuar domenin tuaj t\u00eb rrem\u00eb, duhet t\u00eb p\u00ebrdorni parametrin -fronfDomain:<\/p>\n
\"Domen-fronting
\n
\n\"Domen-fronting
\n
\nTani, akoma nj\u00eb \u00e7\u00ebshtje tjet\u00ebr. Nga ana e paracaktuar, n\u00eb cil\u00ebsimet e llogaris\u00eb n\u00eb CloudFlare \u00ebsht\u00eb aktivizuar moda Flexible SSL. Kjo do t\u00eb thot\u00eb se k\u00ebrkesat https drejt server\u00ebve front-end t\u00eb Cloudflare nga klient\u00ebt do t\u00eb redirektohen n\u00eb m\u00ebnyr\u00eb t\u00eb pa-enkriptuar (http) n\u00eb serverin ton\u00eb. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb arsye ne filluam pjes\u00ebn server t\u00eb tuneluesit n\u00eb modalitetin non-ssl (-listen ws:0.0.0.0), dhe jo (-listen wss:0.0.0.0).<\/p>\n
\"Domen-fronting
\n
\nP\u00ebr t\u00eb kaluar n\u00eb modalitetin e plot\u00eb t\u00eb enkriptimit, duhet t\u00eb zgjidhni Full<\/b>, ose Full (strict)<\/b> n\u00ebse ka nj\u00eb certifikat t\u00eb v\u00ebrtet\u00eb n\u00eb server. Pas kalimit t\u00eb modalitetit, ne do t\u00eb jemi n\u00eb gjendje t\u00eb pranojm\u00eb lidhje nga CloudFlare p\u00ebrmes protokollit https. Mos harroni t\u00eb gjeneroni nj\u00eb certifikat\u00eb self-signed p\u00ebr pjes\u00ebn server t\u00eb tuneluesit.<\/p>\n
\"Domen-fronting
\n
\nLexuesi i v\u00ebmendsh\u00ebm do t\u00eb pyes\u00eb: \"Por si q\u00ebndron me klientin n\u00ebn Windows? Me siguri, p\u00ebrdorimi kryesor i tuneluesit \u00ebsht\u00eb p\u00ebr t\u00eb ngritur nj\u00eb back-connect nga makinat dhe serverat korporativ\u00eb, dhe aty p\u00ebr her\u00eb tjet\u00ebr \u00ebsht\u00eb gjithmon\u00eb Windows. Si mund ta kompiloj tuneluesin p\u00ebr Windows, duke p\u00ebrdorur edhe nj\u00eb stak specifik t\u00eb TLS?\" Tani do t\u00eb paraqesim nj\u00eb tjet\u00ebr funksionalitet q\u00eb tregon se sa i p\u00ebrshtatsh\u00ebm \u00ebsht\u00eb golang. Kompiloni p\u00ebr Windows direkt nga Kali, thjesht duke shtuar parametrin GOOS=windows:<\/p>\n
GOARCH=amd64 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows  go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nOse versionin 32-bit:<\/p>\n
GOARCH=386 GOROOT=\"\/opt\/tls-tris\/_dev\/GOROOT\/linux_amd64\" GOOS=windows  go build -ldflags=\"-s -w\"<\/code><\/pre>\n
\nKjo \u00ebsht\u00eb! Dhe m\u00eb shum\u00eb asgj\u00eb tjet\u00ebr nuk \u00ebsht\u00eb e nevojshme. Kjo funksionon v\u00ebrtet! <\/p>\n
\"Domen-fronting
\n
\nFlagat e kompilatorit -w dhe -s jan\u00eb t\u00eb nevojshme p\u00ebr t\u00eb hequr rrethinat e tep\u00ebrta nga skedari ekzekutiv, duke e b\u00ebr\u00eb at\u00eb m\u00eb t\u00eb vog\u00ebl me disa megabajt. Shtes\u00eb, mund t\u00eb paketoni m\u00eb pas duke p\u00ebrdorur UPX, p\u00ebr t\u00eb zvog\u00ebluar m\u00eb shum\u00eb madh\u00ebsin\u00eb.<\/p>\n
N\u00eb vend t\u00eb p\u00ebrfundimit<\/h3>\n
\nN\u00eb k\u00ebt\u00eb artikull, me shembullin e tuneluesit t\u00eb shkruar n\u00eb golang, kemi ilustruar aplikimin e teknologjis\u00eb s\u00eb re t\u00eb fronting t\u00eb domenit, e realizuar n\u00eb nj\u00eb karakteristik\u00eb mjaft interesante t\u00eb protokollit TLS 1.3. N\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme mund t\u00eb adaptojm\u00eb mjetet ekzistuese t\u00eb shkruara n\u00eb golang p\u00ebr t\u00eb punuar n\u00ebp\u00ebrmjet server\u00ebve CloudFlare, p\u00ebr shembull Merlin<\/a><\/noindex> \u2014 C2 i njohur, ose t\u00eb detyrojm\u00eb CobaltStrike Beacon t\u00eb p\u00ebrdor\u00eb fronting eSNI kur punon me Teamserver p\u00ebrmes External C2 Channel<\/a><\/noindex>, implementuar n\u00eb golang, ose n\u00eb C++ standard me p\u00ebrdorimin e versionit t\u00eb patchuar t\u00eb OpenSSL, p\u00ebr t\u00eb cilin ne fol\u00ebm n\u00eb pjes\u00ebn e kaluar t\u00eb artikullit. N\u00eb p\u00ebrgjith\u00ebsi, fantazia nuk ka kufij.<\/p>\n
Shembulli me tuneluesin dhe CloudFlare \u00ebsht\u00eb paraqitur si nj\u00eb koncept dhe akoma \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb flas\u00ebsh p\u00ebr perspektivat e larg\u00ebta t\u00eb k\u00ebtij lloji t\u00eb fronting t\u00eb domenit. N\u00eb k\u00ebt\u00eb moment, mb\u00ebshtetja e eSNI \u00ebsht\u00eb e realizuar vet\u00ebm nga CloudFlare dhe, n\u00eb parim, asgj\u00eb nuk u pengon atyre t\u00eb \u00e7aktivizojn\u00eb k\u00ebt\u00eb lloj t\u00eb fronting dhe, p\u00ebr shembull, t\u00eb nd\u00ebrpresin lidhjet tls n\u00eb rast t\u00eb mos p\u00ebrputhjes SNI dhe eSNI. N\u00eb p\u00ebrgjith\u00ebsi, e ardhmja do t\u00eb tregoj\u00eb. Por p\u00ebr momentin, perspektiva e pun\u00ebs n\u00ebn \"mbules\u00ebn kremlin.ru\" duket mjaft t\u00ebrheq\u00ebse. A nuk \u00ebsht\u00eb k\u00ebshtu?<\/p>\n
Kodi i azhurnuar i tuneluesit, si dhe skedar\u00ebt ekzekutiv\u00eb t\u00eb kompiliuar jan\u00eb t\u00eb vendosur n\u00eb nj\u00eb deg\u00eb t\u00eb ve\u00e7ant\u00eb t\u00eb projektit n\u00eb github<\/a><\/noindex>. P\u00ebr \u00e7do problem t\u00eb mundsh\u00ebm me tuneluesin, \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb shkruani issue n\u00eb faqen e projektit n\u00eb GitHub.
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI). \u041f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043d\u0430 \u0435\u0433\u043e \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u043b\u043e\u043d\u044f\u0442\u044c\u0441\u044f \u043e\u0442 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438 DPI-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438 (\u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0431\u0438\u043b\u0430\u0439\u043d\u043e\u0432\u0441\u043a\u043e\u0433\u043e DPI \u0438 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0420\u041a\u041d \u0440\u0443\u0442\u0440\u0435\u043a\u0435\u0440\u0430), \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0434\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430. \u0412\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0432\u0435\u0449\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53317","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fronting i domeneve mbi TLS 1.3. Pjesa 2 | ProHoster","description":"Hyrja N\u00eb pjes\u00ebn e par\u00eb t\u00eb artikullit ne ofruam nj\u00eb p\u00ebrmbledhje t\u00eb shkurt\u00ebr t\u00eb mekanizmit encrypted SNI (eSNI).","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3. \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043c\u044b \u0434\u0430\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 encrypted SNI (eSNI).","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53317","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:38","updated":"2026-01-24 06:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53317"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53317\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}