ClientHello Cloner

client.py

from scapy.all import *
import scapy_ssl_tls.ssl_tls as tls
import scapy_ssl_tls.ssl_tls_crypto as tlsc
import scapy_ssl_tls.ssl_tls_keystore as tlsk

packets = rdpcap('tls_example.pcap')

for packet in packets:
  if packet.haslayer(tls.SSL):
    eth = packet
    ip = eth.payload
    tcp = ip.payload
    tls = tcp.payload
    for record in tls.records:
      if record.content_type == 22:   # this is a handshake
        handshakes = record.payload
        for handshake in handshakes.handshakes:
          if handshake.type == 1:   # this is a clienthello
            ch = handshake.payload
            version = ch.version
            cipher_suites = ch.cipher_suites
            server_name = ''
            alpn = ''
            ec_p_f = ''
            ec = ''
            for ext in ch.extensions:
              if ext.type == 0x00:  #server_name
                server_name = ext
              if ext.type == 0x10:  #alpn
                alpn = ext
              if ext.type == 0x0b:  #ec_point_formats
                ec_p_f = ext
              if ext.type == 0x0a:  #elliptic_cureves
                ec = ext
            print version, cipher_suites, server_name, alpn, ec_p_f, ec

feed a client and server script a ClientHello and ServerHello message. Have the client and server create TLS sessions which mimic common applications such as a browser and a web server to bypass TLS fingerprinting/whitelisting.