From caf2ede24c5783196e88377701aee5e057f49419 Mon Sep 17 00:00:00 2001 From: xvzc Date: Tue, 4 Jan 2022 20:19:21 +0900 Subject: [PATCH] update readme --- readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.md b/readme.md index ca1ad90..2daf1cd 100644 --- a/readme.md +++ b/readme.md @@ -41,7 +41,7 @@ Usage: spoof-dpi [options...] Since most of websites in the world now support HTTPS, SpoofDPI doesn't bypass Deep Packet Inspections for HTTP requets, However It still serves proxy connection for all HTTP requests. ### HTTPS - TLS 1.3 encrypts every handshake process, the domain names are still shown as plaintext in the Client hello packet. + Although TLS 1.3 encrypts every handshake process, the domain names are still shown as plaintext in the Client hello packet. In other words, when someone else looks on the packet, they can easily guess where the packet is headed to. The domain name can offer a significant information while DPI is being processed, And we can actually see that the connection is blocked right after sending Client hello packet. I had tried some ways to bypass this, and found out that it seemed like only the first chunk gets inspected when we send the Client hello packet splited in chunks.