Git Product home page Git Product logo

sssniff's Introduction

ss(r)Sniff

Yet another proof of concept of detecting SS(R) traffic. Forked from https://github.com/isofew/sssniff.

It's a demonstration that SS(R) is vulnerable to traffic analysis.

It also shows detecting SSR with traffic analysis is much cheaper than SS, as well as has a much smaller false positive rate.

How it works?

It computes entropy of the first 32 packet lengths of each TCP connection. When the entropy is larger than a threshold, the connection is detected as a SSR connection.

Why it works?

The traffic of SS(R) looks randomized with a relative high entropy of the first 2 to 3 packets. As a result, SS(R) can be detected by computing the entropy of these packets. The drawback is this approach shows high false positive rate and is very expensive.

Besides randomizing traffic, SSR also randomizes the packet lengths, which would cause many packets smaller than MTU. By computing the entropy of the packet lengths, the connection can be detected easily. Without computing the entropy of whole packets, detecting SSR requires much less computing power.

ssSniff

ShadowSocks(SS) traffic sniffer

Aim

Proof of concept of detecting SS traffic. Could be used for the improvement of SS. Or, for the censorship against SS. Either way, it is better to expose the vulnerabilities in advance and take the initiative.

Usage

# install libpcap first, then
pip install -r requirements.txt
sudo ./sssniff.py

Finally, browse the web via your SS proxy. When the script detects more than 15 suspicious connections to/from one source, it will flag it to be a ShadowSocks server and print to the terminal.

Method

ShadowSocks is famous for its randomness feature; however, the first packet of a connection is usually not expected to be random. Even in a TLS session, we expect to see some plaintext sections in the handshake stage. Therefore, one can detect ShadowSocks traffic by simply looking at the first few packets and calculating their entropy (as a measure of randomness). Together with some minor adjustments, this method suffices to detect the current ShadowSocks protocol at a high accuracy.

TODO

  • Develop a more general method to detect proxy traffic.
  • Test for false-positive results.

Credits

  • scapy for packet sniffing/manipulation
  • dpkt for packet parsing/creation

sssniff's People

Contributors

isofew avatar madeye avatar

Stargazers

 avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.