sshhttp-headersssh-tunnelsni

does ssh use sni headers and how SNI inject to ssh tunnel connection


There are lot of tools change the sni in data packet. Does ssh use sni or how HTTP injector likes software change the SNI and browse the around the internet.


Solution

  • SNI is an extension to the TLS protocol which allows a client to specify a virtual domain during the connection handshake, as part of the ClientHello message.

    SSH and TLS are different protocols and SSH does not use SNI. Changing the SNI while making an HTTPS request just requires changing the value the TLS client presents to the target server while connecting, which is, by default, the name of the host used to resolve the IP address of the TLS server; this can be done by openssl, for example, or even by manually adding an entry to your /etc/hosts, pointing a fabricated host name to a TLS server IP address and using the former to connect to the latter. In these cases, TLS clients complain about the name mismatch between the server certificate and the host name (SNI) you are using - but that can usually be turned off.

    Here is how to use a fake SNI example.com while connecting to www.google.com using the openssl's -servername argument:

    openssl s_client -connect www.google.com:443 -servername example.com
    

    And here is how to perform a full HTTPS request using cURL, passing the --insecure option to stop it complaining about the certificate name mismatch as well as manually specifying the Host header (which cURL would otherwise take from the passed URL), with the --connect-to argument used to resolve our host:port fabricated pair to the real one:

    curl --connect-to example.com:443:www.google.com:443 --insecure \
         -H "Host: www.google.com" https://example.com/