-1

There is this application called "TCP over SSL Tunnel". In his office, he only has access to education sites through the internet. He is using this application and connects to an accessible site over the internet and create the TCP over SSL Tunnel. This enables him to access any website on the internet after connecting. Im curious how this application works. I tried to search for the term TCP over SSL and it seems it's not a common term hence i wasn't able to find out much information about it. Could someone please explain what's happening underneath this application when we create the TC

Improve this question
4
  • It sounds as though you're asking for assistance learning how to circumvent network restrictions.
    – music2myear
    Apr 14, 2020 at 4:12
  • @music2myear Actually no. This is already being done. Im curious about what happens underneath. :)
    – Lloyd95
    Apr 14, 2020 at 16:23
  • I’m voting to close this question because the user is trying to learn more about circumventing network security/restrictions. We shouldn't aid or educate anyone with this intent.
    – Tim_Stewart
    May 1, 2020 at 19:52
  • I’m voting to close this question because it is requesting assistance with defeating security measures.
    – MountainMan
    May 2, 2020 at 17:24

1 Answer 1

Reset to default
0

It uses TLS extension SNI (Server Name Indication). The normal duty of this extension is (roughly) to send server which web site you would like to access (as there can be more than one web site hosted on the same IP) during SSL negotiation. So web site can send you it's certificate for the symmetric encryption key exchange. Web site blocking mostly done via this SNI indicator.

Via a proxy-like server on the net and piece of software, you can spoof this header and hide the main site you would like to browse in the encrypted part of the data and surf the web via proxy without getting blocked. Where ever you are browsing, your IP packets will look like you are exchanging data with the permitted web site.

Here is the wireshark output of the extension

Extension: server_name (len=24)
    Type: server_name (0)
    Length: 24
    Server Name Indication extension
        Server Name list length: 22
        Server Name Type: host_name (0)
        Server Name length: 19
        Server Name: clients5.google.com
Improve this answer

Not the answer you're looking for? Browse other questions tagged .