search

sleeyax / burp-awesome-tls

Burp extension to evade TLS fingerprinting. Bypass WAF, spoof any browser.
GNU General Public License v3.0
991 stars 66 forks source link

Add auto TLS fingerprint #51

Closed VovkoO closed 5 months ago

VovkoO commented 6 months ago

Hi, this is reopen of my previous https://github.com/sleeyax/burp-awesome-tls/pull/32.

I finally done with you last comments. I changed the transfer of the config. Now it is passed not through a header in the request, but through a call to the new saveSettings function, which is exported in Go. This made it easier to start an additional proxy only when it is enabled in the advanced settings. It also displays an error as shown in the screenshot below. image

sleeyax commented 6 months ago

Thanks a lot for your persistence, I appreciate your time and effort a lot!

I'll try to have a look later, I'm super busy again.

sleeyax commented 6 months ago

I was wondering if maybe it makes sense to remove the custom hex client hello feature and replace it with this functionality? Seems like the better option as it always adapts to the correct fingerprint and works without having to manually copy paste the hex from WireShark, which is error prone.

VovkoO commented 5 months ago

And thank you for the detailed review, I hope the feature will be useful!

piratesephiroth commented 4 months ago

I was wondering if maybe it makes sense to remove the custom hex client hello feature and replace it with this functionality? Seems like the better option as it always adapts to the correct fingerprint and works without having to manually copy paste the hex from WireShark, which is error prone.

I think the ideal solution would be a mix of both, keeping the field there containing the last intercepted client hello.

sleeyax commented 4 months ago

I think the ideal solution would be a mix of both, keeping the field there containing the last intercepted client hello.

Hmm perhaps. Is there anything you're missing with the new intercept TLS proxy feature? I see it as an improved version of the custom hex client hello field, so don't see much value in bringing it back. Would appreciate it if you can expand on your use case.