https://c57b4987.mrwblog.pages.dev/tags/http/ Recent content in Http on Mr.W's Blog https://c57b4987.mrwblog.pages.dev/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://c57b4987.mrwblog.pages.dev/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo en Sat, 22 Oct 2022 23:36:11 +0000 https://c57b4987.mrwblog.pages.dev/posts/middle_box/ Sat, 22 Oct 2022 23:36:11 +0000 https://c57b4987.mrwblog.pages.dev/posts/middle_box/ <h1 id="abstract">Abstract</h1> <p>There is no absolute safe disguise, all protocols have risks of detected.</p> <h2 id="common-attack-made-by-middle-box">Common attack made by middle box</h2> <ul> <li> <p>Passive analysis (Traffic characteristic, PoC vulnerability) Usually use for plain text protocol or TLS handshake.</p> </li> <li> <p>Active analysis Usually use for Shadowsocks, V2Ray, TLS v1.3 (obtian svers&rsquo;s SSL certificate)</p> </li> <li> <p>replay package</p> </li> </ul> <h2 id="some-obvious-charecteristics-of-proxy-traffic">Some obvious charecteristics of proxy traffic.</h2> <ul> <li> <p>Long connection Most HTTP traffic is short connection.</p> </li> <li> <p>bidireaction flow 99% of Web traffic(HTTP) is one-way flow, which is a group of request match a group of response, few website use websocket.</p>