diff --git a/README.md b/README.md index 3e9fe69..17ecd2d 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -A special compilation of [curl](https://github.com/curl/curl) that makes it impersonate real browsers. Currently supports Chrome & Firefox. This curl binary is able to perform a TLS handshake that is identical to that of a real browser. +A special compilation of [curl](https://github.com/curl/curl) that makes it impersonate real browsers. Currently supports Chrome, Edge & Firefox. This curl binary is able to perform a TLS handshake that is identical to that of a real browser. ## Why? When you use an HTTP client with a TLS website, it first performs a TLS handshake. The first message of that handshake is called Client Hello. The Client Hello message that curl produces differs drastically from that of a real browser. Compare the following Wireshark capture. Left is a regular curl, right is Firefox. @@ -30,6 +30,7 @@ docker build -t curl-impersonate-chrome chrome/ The resulting image contains: * `/build/out/curl-impersonate` - The curl binary that can impersonate Chrome. It is compiled statically against libcurl, BoringSSL, and libnghttp2 so that it won't conflict with any existing libraries on your system. You can use it from the container or copy it out. Tested to work on Ubuntu 20.04. * `/build/out/curl_chrome98` - A wrapper script that launches `curl-impersonate` with the needed headers and ciphers to impersonate Chrome 98. +* `/build/out/curl_edge98` - Same but with Edge 98 (which is based on Chromium). You can use them inside the docker, copy them out using `docker cp` or use them in a multi-stage docker build. If you use it outside this container: * Install dependencies: `sudo apt install libbrotli1` diff --git a/chrome/Dockerfile b/chrome/Dockerfile index c1cf986..63e0076 100644 --- a/chrome/Dockerfile +++ b/chrome/Dockerfile @@ -74,6 +74,6 @@ RUN mkdir out && \ cp ${CURL_VERSION}/src/curl out/curl-impersonate # Wrapper script -COPY curl_chrome* out/ +COPY curl_chrome* curl_edge* out/ RUN chmod +x out/* diff --git a/chrome/curl_edge98 b/chrome/curl_edge98 new file mode 100755 index 0000000..8244502 --- /dev/null +++ b/chrome/curl_edge98 @@ -0,0 +1,24 @@ +#!/bin/bash + +# Find the directory of this script +dir=`echo "$0" | sed 's%/[^/]*$%%'` + +# The list of ciphers can be obtained by looking at the Client Hello message in +# Wireshark, then converting it using this reference +# https://wiki.mozilla.org/Security/Cipher_Suites +"$dir/curl-impersonate" \ + --ciphers TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,ECDHE-RSA-AES128-SHA,ECDHE-RSA-AES256-SHA,AES128-GCM-SHA256,AES256-GCM-SHA384,AES128-SHA,AES256-SHA \ + -H 'sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="98", "Microsoft Edge";v="98"' \ + -H 'sec-ch-ua-mobile: ?0' \ + -H 'sec-ch-ua-platform: "Windows"' \ + -H 'Upgrade-Insecure-Requests: 1' \ + -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36 Edg/98.0.1108.62' \ + -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \ + -H 'Sec-Fetch-Site: none' \ + -H 'Sec-Fetch-Mode: navigate' \ + -H 'Sec-Fetch-User: ?1' \ + -H 'Sec-Fetch-Dest: document' \ + -H 'Accept-Encoding: gzip, deflate, br' \ + -H 'Accept-Language: en-US,en;q=0.9' \ + --http2 --false-start --tlsv1.2 --compressed \ + $@ diff --git a/tests/signatures.yaml b/tests/signatures.yaml index 20aaa68..8e042df 100644 --- a/tests/signatures.yaml +++ b/tests/signatures.yaml @@ -82,6 +82,83 @@ signature: data: !!binary AA== - type: padding --- +name: edge_98.0.1108.62_win10 +browser: + name: edge + version: 98.0.1108.62 + os: win10 + mode: regular +signature: + tls_client_hello: + record_version: 'TLS_VERSION_1_0' + handshake_version: 'TLS_VERSION_1_2' + session_id_length: 32 + ciphersuites: [ + 'GREASE', + 0x1301, 0x1302, 0x1303, 0xc02b, 0xc02f, 0xc02c, 0xc030, + 0xcca9, 0xcca8, 0xc013, 0xc014, 0x009c, 0x009d, 0x002f, + 0x0035 + ] + comp_methods: [0x00] + extensions: + - type: GREASE + length: 0 + - type: server_name + - type: extended_master_secret + length: 0 + - type: renegotiation_info + length: 1 + - type: supported_groups + length: 10 + supported_groups: [ + 'GREASE', + 0x001d, 0x0017, 0x0018 + ] + - type: ec_point_formats + length: 2 + ec_point_formats: [0] + - type: session_ticket + length: 0 + - type: application_layer_protocol_negotiation + length: 14 + alpn_list: ['h2', 'http/1.1'] + - type: status_request + length: 5 + status_request_type: 0x01 + - type: signature_algorithms + length: 18 + sig_hash_algs: [ + 0x0403, 0x0804, 0x0401, 0x0503, + 0x0805, 0x0501, 0x0806, 0x0601 + ] + - type: signed_certificate_timestamp + length: 0 + - type: keyshare + length: 43 + key_shares: + - group: GREASE + length: 1 + - group: 29 + length: 32 + - type: psk_key_exchange_modes + length: 2 + psk_ke_mode: 1 + - type: supported_versions + length: 7 + supported_versions: [ + 'GREASE', 'TLS_VERSION_1_3', 'TLS_VERSION_1_2' + ] + - type: compress_certificate + length: 3 + algorithms: [0x02] + - type: application_settings + length: 5 + alps_alpn_list: ['h2'] + - type: GREASE + length: 1 + data: !!binary AA== + - type: padding +--- name: firefox_91.6.0esr_win10 browser: name: firefox diff --git a/tests/test_impersonate.py b/tests/test_impersonate.py index 3f2b108..8a6adb8 100644 --- a/tests/test_impersonate.py +++ b/tests/test_impersonate.py @@ -179,6 +179,7 @@ class TestImpersonation: "curl_binary, expected_signature", [ ("chrome/curl_chrome98", "chrome_98.0.4758.102_win10"), + ("chrome/curl_edge98", "edge_98.0.1108.62_win10"), ("firefox/curl_ff91esr", "firefox_91.6.0esr_win10"), ("firefox/curl_ff95", "firefox_95.0.2_win10") ]