search

lwthiker / curl-impersonate

curl-impersonate: A special build of curl that can impersonate Chrome & Firefox
MIT License
3.63k stars 238 forks source link

Does it work when using proxy? #71

Closed AndriusCTR closed 2 years ago

AndriusCTR commented 2 years ago

If I use curl --proxy and send it to http proxy, will it properly forward everything to destination server as intended?

Dantenerosas commented 2 years ago

I've tested with jsonip.com and response included proxy's ip, so I'd say yes, it should properly forward everything

AndriusCTR commented 2 years ago

I've tested with jsonip.com and response included proxy's ip, so I'd say yes, it should properly forward everything

The question is does the receiving server sees all headers/tls fingerprint properly? I tried against one site and it detected me.

jlcd commented 2 years ago

We are using curl-impersonate on large scale (100 requests/second) against akamai (one of the leading WAFs on the market) and it's going just fine, both in terms of headers and proxies. So I'd say curl-impersonate is working as intented and you probably have some other issues with your headers/IPs.

Bear in mind that curl-impersonate overwrites some headers (eg. User Agent), but it shouldn't be an issue for most cases and actually helps.

AndriusCTR commented 2 years ago

We are using curl-impersonate on large scale (100 requests/second) against akamai (one of the leading WAFs on the market) and it's going just fine, both in terms of headers and proxies. So I'd say curl-impersonate is working as intented and you probably have some other issues with your headers/IPs.

Bear in mind that curl-impersonate overwrites some headers (eg. User Agent), but it shouldn't be an issue for most cases and actually helps.

Thanks jlcd, must be an issue on my end.

AndriusCTR commented 2 years ago

agree. highly depends on anti-bot vendor. maybe your proxy is bad. or they check tcp fingerprints

The whole idea of curl-impersonate is tcp fingerprint.

AndriusCTR commented 2 years ago

agree. highly depends on anti-bot vendor. maybe your proxy is bad. or they check tcp fingerprints

The whole idea of curl-impersonate is tcp fingerprint.

you are stupid )) this is not possible as for now You are completely wrong, so I can imagine what you do. Probably easy to detect

как русский, так долбоёб.

How about you show some solutions how to avoid tcp fingerprint detection instead?

AndriusCTR commented 2 years ago

btw did you read or forgot glasses again? I wrote, it is not possible to spoof tcp as for now only if you own proxy. but still there are would be a problem with webrtc. which is not possible to solve correctly as for now. when using proxies no mitigation possible

Русский военный корабль, иди на хуй

lwthiker commented 2 years ago

I didn't quite follow this thread but please refrain from insults.

As for the original question: I do not believe a proxy will forward the TLS fingerprint as curl-impersonate sends it. A web proxy will use its own TLS code with its TLS library of choice. The HTTP headers will probably be fine though, but this is not sufficient in many cases.

If you'd like to make a thorough check, please use your proxy of choice with curl-impersonate and run the following

curl_chrome101 --proxy $YOUR_PROXY -X GET 'https://ja3er.com/json'

This will give some details about the TLS signature that the proxy emits.

AndriusCTR commented 2 years ago

On 2022-05-27 16:11, vladtreny wrote:

I didn't quite follow this thread but please refrain from insults.

As for the original question: I do not believe a proxy will
forward the TLS fingerprint as curl-impersonate sends it. A web
proxy will use its own TLS code with its TLS library of choice.
The HTTP headers will probably be fine though, but this is not
sufficient in many cases.

If you'd like to make a thorough check, please use your proxy of
choice with curl-impersonate and run the following

|curl_chrome101 --proxy $YOUR_PROXY -X GET 'https://ja3er.com/json' |

This will give some details about the TLS signature that the proxy
emits.

Hello, some proxy providers forward it. I've just checked my 3 providers and it works. So depends on quality of proxy provider

Nobody talks about proxy providers. We are talking about proxy servers (e.g. squid on ubuntu). And which settings there should/could be changed to make it 'forward' TLS fingerprint

AndriusCTR commented 2 years ago

On 2022-05-27 16:26, vladtreny wrote:

Nobody talks about proxy providers. We are talking about proxy
servers (e.g. squid on ubuntu). And which settings there
should/could be changed to make it 'forward' TLS fingerprint

Then you should write clearly what exactly you want to know (I hope you do not suffer from bipolar disorder). So you want to know how to configure the server?

The original question was different

Message ID: @.***>

You have problems with reading text, not me (how old are you? 25?). The original question was how to use it with proxy and not with proxy provider. Read again 10 times if you can't understand what's written or just stop responding at all.

jlcd commented 2 years ago

@AndriusCTR and @vladtreny can you please stop using this forum as a mean to exchange insults/discuss between you two? It doesn't add to the open issue.

As for the TLS FP being forwarded by any proxy providers/servers, if your proxy provider does a sort of MiM attack to sniff the https content, the TLS will change, as they will need to redo the handshake themselves. But if the https is just being forwarded, the TLS FP should stay the same.

As @lwthiker mentioned, you can test the final FP here: https://ja3er.com/json

AndriusCTR commented 2 years ago

On 2022-05-27 16:32, João Drummond wrote:

@AndriusCTR https://github.com/AndriusCTR and @vladtreny https://github.com/vladtreny can you please stop using this forum as a mean to exchange insults/discuss between you two? It doesn't add to the open issue.

As for the TLS FP being forwarded by any proxy providers/servers, if your proxy provider does a sort of MiM attack to sniff the https content, the the TLS will change, as they will need to redo the handshake themselves. But if the https is just being forwarded, the TLS FP should keep the same.

As @lwthiker https://github.com/lwthiker mentioned, you can test the final FP here: https://ja3er.com/json https://ja3er.com/json

— Reply to this email directly, view it on GitHub https://github.com/lwthiker/curl-impersonate/issues/71#issuecomment-1139623632, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHUMIDWEYDJ35XA34JHMANLVMDFHZANCNFSM5W576RIQ. You are receiving this because you were mentioned.Message ID: @.***>

Thanks @João. The question is regarding using your own squid proxy (another server). Not proxy providers.

ghost commented 1 year ago

We are using curl-impersonate on large scale (100 requests/second) against akamai (one of the leading WAFs on the market) and it's going just fine, both in terms of headers and proxies. So I'd say curl-impersonate is working as intented and you probably have some other issues with your headers/IPs.

Bear in mind that curl-impersonate overwrites some headers (eg. User Agent), but it shouldn't be an issue for most cases and actually helps.

what platform are you using this on, linux, windows? If linux would you mind sharing how you set up your project to get these libraries to work, I'm having some issues trying to use them with mine and an example would be nice