mirror of https://github.com/Kkevsterrr/geneva
481 lines
21 KiB
Python
481 lines
21 KiB
Python
|
# The following strategies have been learned as successful against the Great Firewall.
|
||
|
|
WORKING_STRATEGIES = [
|
||
|
|
{
|
||
|
|
"strategy" : "\/",
|
||
|
|
"success_rate" : .03,
|
||
|
|
"description" : "No strategy",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
|
||
|
|
# TCB Desync - High DataOfs
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:10}(tamper{TCP:chksum:replace:25776},),)-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "TCP Desync - Increment Dataofs - Corrupt Chksum",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:10}(tamper{IP:ttl:replace:10},),)-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "TCP Desync - Increment Dataofs - Small TTL",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:10}(tamper{TCP:flags:replace:FRAPUN},),)-",
|
||
|
|
"success_rate" : .26,
|
||
|
|
"description" : "TCP Desync - Increment Dataofs - Invalid Flags",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:10}(tamper{TCP:ack:corrupt},),)-",
|
||
|
|
"success_rate" : .94,
|
||
|
|
"description" : "TCP Desync - Increment Dataofs - Corrupt ACK",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:options-wscale:corrupt}(tamper{TCP:dataofs:replace:8},),)-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "TCP Desync - Increment Dataofs - Corrupt WScale",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# TCB Desync - Load corruption
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:load:corrupt}(tamper{TCP:chksum:corrupt},),)-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "TCP Desync - Invalid Payload - Corrupt Chksum",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:load:corrupt}(tamper{IP:ttl:replace:8}(duplicate(fragment{tcp:-1:False},),),),)-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "TCP Desync - Invalid Payload - Small TTL",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:load:corrupt}(tamper{TCP:ack:corrupt}(duplicate(fragment{tcp:-1:False},),),),)-",
|
||
|
|
"success_rate" : .93,
|
||
|
|
"description" : "TCP Desync - Invalid Payload - Corrupt ACK",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
|
||
|
|
# TCB Teardown (with RST)
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:R}(tamper{TCP:chksum:corrupt},))-",
|
||
|
|
"success_rate" : .95,
|
||
|
|
"description" : "TCB Teardown - with RST - Corrupt Chksum, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:R}(tamper{TCP:chksum:corrupt},),)-",
|
||
|
|
"success_rate" : .51,
|
||
|
|
"description" : "TCB Teardown - with RST - Corrupt Chksum, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:R}(tamper{IP:ttl:replace:10},))-",
|
||
|
|
"success_rate" : .87,
|
||
|
|
"description" : "TCB Teardown - with RST - Small TTL, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:R}(tamper{IP:ttl:replace:9},),)-",
|
||
|
|
"success_rate" : .52,
|
||
|
|
"description" : "TCB Teardown - with RST - Small TTL, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:options-md5header:corrupt}(tamper{TCP:flags:replace:R},))-",
|
||
|
|
"success_rate" : .86,
|
||
|
|
"description" : "TCB Teardown - with RST - Invalid md5Header, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:options-md5header:corrupt}(tamper{TCP:flags:replace:RA},),)-",
|
||
|
|
"success_rate" : .44,
|
||
|
|
"description" : "TCB Teardown - with RST - Invalid md5Header, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# Teardown with RST/ACK
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:RA}(tamper{TCP:chksum:replace:27925},))-",
|
||
|
|
"success_rate" : .90,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Corrupt Chksum, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:RA}(tamper{TCP:chksum:replace:27925},),)-",
|
||
|
|
"success_rate" : .66,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Corrupt Chksum, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:RA}(tamper{IP:ttl:replace:10},))-",
|
||
|
|
"success_rate" : .94,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Small TTL, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:RA}(tamper{IP:ttl:replace:10},),)-",
|
||
|
|
"success_rate" : .57,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Small TTL, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:options-md5header:corrupt}(tamper{TCP:flags:replace:R},))-",
|
||
|
|
"success_rate" : .94,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Invalid md5Header, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:options-md5header:corrupt}(tamper{TCP:flags:replace:R},),)-",
|
||
|
|
"success_rate" : .48,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Invalid md5Header, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:RA}(tamper{TCP:ack:corrupt},),)-",
|
||
|
|
"success_rate" : .43,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Corrupt ACK, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:RA}(tamper{TCP:ack:corrupt},))-",
|
||
|
|
"success_rate" : .31,
|
||
|
|
"description" : "TCB Teardown - with RST/ACK - Corrupt ACK, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# TCB Teardown w/ Invalid Flags
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:FRAPUEN}(tamper{TCP:chksum:corrupt},))- ",
|
||
|
|
"success_rate" : .89,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Corrupt Chksum, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:FRAPUEN}(tamper{TCP:chksum:corrupt},),)-",
|
||
|
|
"success_rate" : .48,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Corrupt Chksum, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:FREACN}(tamper{IP:ttl:replace:10},))-",
|
||
|
|
"success_rate" : .96,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Small TTL, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:FRAPUEN}(tamper{IP:ttl:replace:10},),)-",
|
||
|
|
"success_rate" : .56,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Small TTL, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(,tamper{TCP:flags:replace:FRAPUN}(tamper{TCP:options-md5header:corrupt},))-",
|
||
|
|
"success_rate" : .94,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Invalid md5Header, High Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:FRAPUEN}(tamper{TCP:options-md5header:corrupt},),)-",
|
||
|
|
"success_rate" : .55,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Invalid md5Header, Low Percentage",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-tamper{TCP:load:replace:a5z2}(tamper{TCP:flags:replace:CN},)-",
|
||
|
|
"success_rate" : .00,
|
||
|
|
"description" : "TCB Teardown - Invalid Flags - Invalid Payload",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# Segmentation
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:8:False}-|[TCP:flags:A]-tamper{TCP:seq:replace:2258679050}-",
|
||
|
|
"success_rate" : .92,
|
||
|
|
"description" : "Segmentation - With ACK - Offsets, subvariant 1",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:8:False}-| [TCP:flags:A]-tamper{TCP:seq:replace:2258679050}(tamper{TCP:flags:replace:PA},)-",
|
||
|
|
"success_rate" : .95,
|
||
|
|
"description" : "Segmentation - With ACK - Offsets, subvariant 2",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:8:True}(,fragment{tcp:4:True})-",
|
||
|
|
"success_rate" : .98,
|
||
|
|
"description" : "Segmentation - Reassembly - Offsets, subvariant 1",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:4:True}(,fragment{tcp:19:True})-",
|
||
|
|
"success_rate" : .96,
|
||
|
|
"description" : "Segmentation - Reassembly - Offsets, subvariant 2",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# Hybrid Strategies
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:flags:replace:F}(tamper{IP:len:replace:68},),)-| \/",
|
||
|
|
"success_rate" : .53,
|
||
|
|
"description" : "Hybrid Strategy - HTTP - Fragment and set Fin flag",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:flags:replace:F}(tamper{IP:len:replace:68},),)-| \/",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Hybrid Strategy - DNS Over TCP - Fragment and set Fin flag",
|
||
|
|
"test_type" : "dns_tcp",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# Server-side strategies
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:SA]-duplicate(tamper{TCP:flags:replace:FREC}(duplicate,),tamper{TCP:flags:replace:FSEC})-| \/",
|
||
|
|
"success_rate" : .43,
|
||
|
|
"description" : "Server-Side - Simultaneous Open",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : True,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# DNS over UDP strategies
|
||
|
|
{
|
||
|
|
"strategy" : "\/ [UDP:sport:53:2]-drop-",
|
||
|
|
"success_rate" : .96,
|
||
|
|
"description" : "DNS - Drop first two bad responses",
|
||
|
|
"test_type" : "dns",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "china"
|
||
|
|
},
|
||
|
|
# India HTTP strategies
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:options-altchksum:]-tamper{TCP:options-uto:corrupt}(duplicate,)-| \/",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Invalid Options",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:options-mss:]-tamper{TCP:options-md5header:corrupt}-| \/",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Invalid Options",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{TCP:dataofs:replace:9},)-| \/",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Increasing dataofs",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{IP:len:replace:64},)-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "IP length",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:-1:True}-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Segmentation",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:SA]-tamper{TCP:window:replace:98}-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Server side",
|
||
|
|
"test_type" : "http",
|
||
|
|
"server_side" : True,
|
||
|
|
"country" : "india"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-fragment{tcp:-1:True}-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Segmentation",
|
||
|
|
"test_type" : "kazakhstan_injected_https",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "kazakhstan"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:PA]-duplicate(tamper{IP:len:replace:78},)-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Segmentation Exploit - Small IP length",
|
||
|
|
"test_type" : "kazakhstan_injected_https",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "kazakhstan"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:S]-duplicate(,tamper{TCP:load:corrupt})-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "Desync: load on second SYN",
|
||
|
|
"test_type" : "kazakhstan_injected_https",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "kazakhstan"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:S]-duplicate(tamper{TCP:flags:replace:SA},)-|",
|
||
|
|
"success_rate" : 1,
|
||
|
|
"description" : "TCB Turnaround",
|
||
|
|
"test_type" : "kazakhstan_injected_https",
|
||
|
|
"server_side" : False,
|
||
|
|
"country" : "kazakhstan"
|
||
|
|
},
|
||
|
|
]
|
||
|
|
|
||
|
|
# Strategies that evade the lab censors
|
||
|
|
LAB_STRATEGIES = [
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-tamper{TCP:flags:replace:F}-| \/",
|
||
|
|
"censors" : ["censor6", "censor7", "censor8"],
|
||
|
|
"description" : "Interrupts the 3-way handshake with a FIN. The server ignores the FIN, as \
|
||
|
|
the 3-way handshake has not been done yet, so there is no connection to teardown. \
|
||
|
|
Since the client's very next packet is a PSH-ACK, the ACK in this packet serves to \
|
||
|
|
complete the 3-way handshake, but the censor tears down it's TCB at the FIN."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:seq:corrupt}(tamper{TCP:flags:replace:R},),)-| \/",
|
||
|
|
"censors" : ["censor6", "censor7"],
|
||
|
|
"description" : "Tears down a TCB right after a 3-way handshake by injecting a RST packet."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:R}(tamper{TCP:chksum:corrupt},),)-| \/",
|
||
|
|
"censors" : ["censor6", "censor7", "censor8", "censor8b"],
|
||
|
|
"description" : "Creates a RST injection packet to tear down a TCB and corrupts the checksum, exploiting a censor \
|
||
|
|
that does not validate packet checksums."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "\/ [TCP:dataofs:5]-drop-|",
|
||
|
|
"censors" : ["censor2"],
|
||
|
|
"description" : "RST Packets (at least those constructed with scapy) have a data offset of 5. This \
|
||
|
|
beats a censor that only sends RSTs to the client by dropping the RST packets."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "\/ [TCP:flags:R]-drop-|",
|
||
|
|
"censors" : ["censor2"],
|
||
|
|
"description" : "Beats a censor that only sends RSTs to the client by dropping the RST packets."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "\/ [TCP:window:8192]-drop-|",
|
||
|
|
"censors" : ["censor2"],
|
||
|
|
"description" : "RST Packets (at least those constructed with scapy) have a default window size of 8192. This \
|
||
|
|
beats a censor that only sends RSTs to the client by dropping the RST packets."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:R}(tamper{TCP:chksum:replace:14239},),duplicate(tamper{TCP:flags:replace:S}(tamper{TCP:chksum:replace:14239},),))-| \/",
|
||
|
|
"censors" : ["censor1", "censor2", "censor3", "censor5", "censor6", "censor7", "censor8", "censor8b", "censor9"],
|
||
|
|
"description" : "Triggers a RST packet and SYN packet to be sent immediately after the 3-way handshake \
|
||
|
|
finishes. The server ignores the RST, as the chksum is corrupted, and ignores the SYN, \
|
||
|
|
as a connection is already up. The censor sees the RST and enters the resynchronization \
|
||
|
|
state, and the immediate follow-up SYN packet causes the TCB to be deschronized from the \
|
||
|
|
real connection."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:flags:replace:R}(tamper{TCP:chksum:replace:15239},),duplicate(tamper{TCP:flags:replace:S}(tamper{TCP:seq:corrupt}(tamper{TCP:chksum:corrupt},),),))-| \/",
|
||
|
|
|
||
|
|
"censors" : ["censor1", "censor2", "censor3", "censor5", "censor6", "censor7", "censor8", "censor8b", "censor9"],
|
||
|
|
"description" : "Triggers a RST packet and SYN packet to be sent immediately after the 3-way handshake \
|
||
|
|
finishes. The server ignores the RST, as the chksum is corrupted, and ignores the SYN, \
|
||
|
|
as a connection is already up. The censor sees the RST and enters the resynchronization \
|
||
|
|
state, and the immediate follow-up SYN packet with a new seq causes the TCB to be deschronized from the \
|
||
|
|
real connection."
|
||
|
|
},
|
||
|
|
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-tamper{TCP:dataofs:replace:0}-| \/",
|
||
|
|
"censors" : ["censor1", "censor2", "censor3", "censor5", "censor9", "censor10"],
|
||
|
|
"description" : "The dataofs field in the TCP header tells applications where the payload of the packet \
|
||
|
|
starts. By replacing the dataofs to 0 on a packet without a payload (ACK), it makes the \
|
||
|
|
TCP header look like data. Servers ignore this, but a censor that is trying to keep a TCB \
|
||
|
|
synchronized will be desynchronized from the connection when it gets a payload of an incorrect \
|
||
|
|
length."
|
||
|
|
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"strategy" : "[TCP:flags:A]-duplicate(tamper{TCP:dataofs:replace:0},)-| \/",
|
||
|
|
"censors" : ["censor1", "censor2", "censor3", "censor5", "censor9", "censor10"],
|
||
|
|
"description" : "The dataofs field in the TCP header tells applications where the payload of the packet \
|
||
|
|
starts. By replacing the dataofs to 0 on a packet without a payload (ACK), it makes the \
|
||
|
|
TCP header look like data. Servers ignore this, but a censor that is trying to keep a TCB \
|
||
|
|
synchronized will be desynchronized from the connection when it gets a payload of an incorrect \
|
||
|
|
length. This strategy is functionally equivalent to the above strategy, but also preserves the \
|
||
|
|
original packet."
|
||
|
|
|
||
|
|
},
|
||
|
|
]
|