Fingerprinting Captured Client Hello

[arashammm]

Hello again to the beloved xray community.

Xray is a very promising project amongst new circumventing tools for bypassing firewalls.

I wanted to request an enhancement to this project for the savy who want to use their own captured client hello fingerprint in tls proxies such as XTLS.

It would be great if we had the ability to capture a regular client hello packet from our browser to camouflage website and implement that inside xray core (client-side).
I know that utls has this option in itself and with little tweaking inside the xray code this method is possible.

This way we get a vary wide range of unique fngerprints for each set up which makes it very hard to be flagged.

Right now, the default fingerprints in xray/utls are flagged and recognized very easily after a day or so.

And at the end, if anyone could help me to where to look in xray codes to confgiure that option I would appreciate it.

[cross-hello]

"tlsSettings": {
  "fingerprint": "randomized"
}

[arashammm]

"tlsSettings": {
  "fingerprint": "randomized"
}

can you elaborate more?
how can I use randomized to implement my custome fingerprint?
I couldn't find that anywhere

[cross-hello]

None, can't customize to specify fingerprint in configuration. "fingerprint": "randomized" generate a new fingerprint for you each time. Mar 13, 2023 08:41:49 arashammm ***@***.***>:

…

"tlsSettings": { "fingerprint": "randomized" } can you elaborate more? how can I use randomized to implement my custome fingerprint? I couldn't find that anywhere — Reply to this email directly, view it on GitHub[#1782 (comment)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYCHPWZZAVMGQ5K4KUDW3ZUMZANCNFSM6AAAAAAVYLGGFI]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYAAQNE2LJZ4Q6MLBQLW3ZUMZA5CNFSM6AAAAAAVYLGGFKWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSXK53WU.gif]

[arashammm]

None, can't customize to specify fingerprint in configuration. "fingerprint": "randomized" generate a new fingerprint for you each time. Mar 13, 2023 08:41:49 arashammm @.***>:
…

Thanks for the clarification.
so it seems this would be a viable option to add in future releases. Don’t you think?

Btw, with randomized we can get a randomized client hello with random bytes from firefox, chrome, and ios?

[bcegkmqs23]

Btw, with randomized we can get a randomized client hello with random bytes from firefox, chrome, and ios?

If I didn't misremember: "random" means randomly choose one from "firefox", "chrome" etc., and "randomized" means a generated completely random fingerprint.

[zxcvos]

Xray-docs-next

"random": randomly select one in newer versions of browsers
"randomized": generate a completely random and unique fingerprint (100% compatible with TLS 1.3 using X25519)

[GreatMichaelLee]

so I am just wondering, which one will be less recognizable patten between 'random','randomized' and a paticular fingerprint? If my setup is only having the traffic among my softrouter and mobile phone to VPS(M to 1）, does that mean random will be more safer since it looks like more real?

[RPRX]

这是个很好的想法，建议在 uTLS 也发一下

[arashammm]

a, I suggest posting it in uTLS

Thanks for the suggestion RPRX.
but I think they implemented this kind of action in their code earlier.

See here.

I think this model of fingerprinting should be the standard. Because right now fingerprints like chrome 106 auto shuffle are so obvious and will be blocked within days if not hours.

[arashammm]

ing, which one will be less recognizable patten between 'random','randomized' and a paticular fingerprint? If my setup is only having the traffic among my softrouter and mobile phone to VPS(M to 1）, does that mean random will be more safer since it

Obviously randomized option is more unique and less recognizable in that manner.
But I don't know exactly how "randomized" works and maybe the created fingerprint works but it's not like any other typical browser fingerprint which makes it more recognizable in that way.

And this brings me back to my main question earlier. how exactly randomized fingerprint works?? like what cipher suites it will choose from randomly?

[elrazez]

I'm still wondering which one is the best at keeping the server IP undetected from GFW: random, randomized or a static one (chrome, firefox, etc.).

any explanations/suggestions would be appreciated.

[elrazez]

ok found this:

          https://github.com/XTLS/Xray-core/commit/f32921df307d80063fddcd5e6aa11d95f57f394e

But we should avoid using it unless we have to, see refraction-networking/utls#157 (comment)

简单来说，当你所在的地区连常规浏览器的指纹都封锁时，可以试一下 randomized 指纹，否则不要用。

Originally posted by @RPRX in #1752 (comment)

Translation: In short, when you are in an area where even regular browser fingerprinting is blocked, you can try randomized fingerprinting, otherwise don't use it.