+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] spoof TLS ClientHello message in python (/showthread.php?tid=5935049)
spoof TLS ClientHello message in python - serwking - Jan 28, 2019
I'm trying to spoof my TLS ClientHello message in python requests so it's the same as chrome's. I managed to create a SSLContext and add the necessary ciphers, but I can't get rid of the TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite. It's not being overwritten by the set_ciphers method.
Can anyone show me how I can get that part removed from the cipher suites?
RE: spoof TLS ClientHello message in python - Ghxst - Feb 7, 2019
TLS_EMPTY_RENEGOTIATION_INFO_SCSV is not a real cipher suite, maybe it's not implemented where you think it is?
I'll do some digging but it might be implemented at a lower level.
Can you share your code so I can test?
Also, are you / chrome sending renegotiation_info ?
According to RFC 5746#section-3.4 :
The client MUST include either an empty "renegotiation_info"
extension, or the TLS_EMPTY_RENEGOTIATION_INFO_SCSV signaling
cipher suite value in the ClientHello. Including both is NOT
RECOMMENDED.