Agent skill · security · aradotso
sni-spoofing-dpi-bypass
sni-spoofing-dpi-bypass — an agent skill for coding agents.
Why this skill is useful
Adds a complete Python tool for bypassing DPI using SNI spoofing and TCP/IP manipulation, which includes executable scripts and domain-specific techniques not commonly known.
What it needs
Requires python, scapy installed locally. About 5k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
bash git clone https://github.com/patterniha/SNI-Spoofing.git cd SNI-Spoofing pip install -r requirements.txt bash pip install scapy bash Drop kernel RST packets for the port you're intercepting sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP SNI-Spoofing/ ├── main.py # Entry point / core proxy logic ├── sni.py # SNI extraction and packet splitting ├── utils.py # Helper functions (checksum, headers) └── requirements.txt python def extractsni(data: bytes) -> str None: """ Extract the SNI hostname from a raw TLS ClientHello payload. Returns None if not found. """ try: if data[0] != 0x16: # TLS Handshake return None if data[5] != 0x01: # ClientHello return None # Skip TLS record header (5 bytes) + handshake header (4 bytes) # + clientversion (2) + random (32) + sessionidlength (1+n) pos = 9 sessionidlen = data[pos] pos += 1 + sessionidlen # Skip cipher suites ciphersuiteslen = int.frombytes(data[pos:pos+2], 'big') pos += 2 + ciphersuiteslen # Skip compression methods compressionlen = data[pos] pos += 1 + compressionlen # Extensions extensionslen = int.frombytes(data[pos:pos+2], 'big') pos += 2 end = pos + extensionslen while pos < end: exttype = int.frombytes(data[pos:pos+2], 'big') extlen = int.frombytes(data[pos+2:pos+4], 'big') pos += 4 if exttype == 0x0000: # SNI extension # servernamelistlength (2) + nametype (1) + namelength (2) namelen = int.frombytes(data[pos+3:pos+5], 'big') return data[pos+5:pos+5+namelen].decode('utf-8') pos += extlen except Exception: return None return None python from scapy.all import IP, TCP, Raw, send def sendfragmentedclienthello( dstip: str, dstport: int, srcport: int, seq: int, clienthello: bytes, splitposition: int = None ): """ Split TLS ClientHello into two TCP segments at splitposition. Default split: right before the SNI hostname bytes. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/sni-spoofing-dpi-bypass