Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"There’s ways to get around TLS signatures but it’s much harder and requires a lot more legwork to get working"

I wouldn't call it "much harder". All you need to bypass the signature is to choose random ciphers (list at https://curl.se/docs/ssl-ciphers.html) and you mash them up in a random order separated by colons in curl's --ciphers option. If you pick 15 different ciphers in a random order, there are over a trillion signatures possible, which he couldn't block. For example this works:

  $ curl --ciphers AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA:... https://foxmoss.com/blog/packet-filtering/
But, yes, most bots don't bother randomizing ciphers so most will be blocked.


It can be much more easier and realistic with https://github.com/lexiforest/curl-impersonate.


This works for the ten minute period it takes to switch from a blacklist to a whitelist




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: