Unveiling Trojan and AnyTLS: Stripping TLS and Harnessing Reality for Enhanced Proxy Connections

This article delves into advanced proxy techniques, demonstrating how to customize and optimize proxy connections by stripping TLS from the Trojan protocol and implementing AnyReality. It provides a detailed guide for tech professionals and enthusiasts looking to enhance their understanding and control over proxy configurations.

Understanding Proxy Protocol Layers

The configuration of proxy data can be divided into three distinct layers:

• Proxy Protocol (Top Layer): This includes protocols like SS, Vmess, Vless, Trojan, Socks, and AnyTLS.
• Transport Method (Middle Layer): This layer dictates how data processed by the proxy protocol is transmitted. Examples include Raw, WS, KCP, gRPC, XHTTP, and HTTP Upgrade.
• Transport Security (Bottom Layer): This layer focuses on securing the transmission using technologies like TLS and Reality.

This layered approach allows for flexible combinations, such as Vmess+WS, SS+GRPC+Reality, or custom configurations.

Demonstrating Protocol Combinations Through Network Packet Capture

To illustrate the impact of different protocol combinations, the article walks through a series of network packet capture demonstrations using Wireshark. This process reveals the structure and characteristics of various proxy configurations.

Example 1: Unencrypted Shadowsocks (SS)

The demonstration begins with an unencrypted SS connection, showcasing the raw TCP communication. Key observations include:

• TCP three-way handshake to establish a connection.
• The structure of the SS protocol is clearly visible, including the target domain and port.
• Data is transmitted without encryption, making it vulnerable to interception.

Example 2: AES-Encrypted Shadowsocks (SS)

Next, the demonstration shifts to an AES-encrypted SS connection. Here’s what’s observed:

• Data is encrypted, appearing as random characters in the packet capture.
• The size of the data packet increases due to encryption overhead.

SS+WebSocket (WS) Configuration

The guide illustrates the setup of an SS+WS node, detailing parameter modifications and traffic capture results. Key points include:

• A HTTP request is initiated, upgrading the connection to WebSocket.
• Subsequent data transmission occurs within the WebSocket connection, with SS data encrypted via AES.

SS+Reality Configuration

Due to limited support in common proxy tools like v2rayN, manual configuration of SS+Reality is required. Key steps include:

• Configuring Xray to run locally with the SS+Reality settings.
• Traffic appears to be standard HTTP traffic to Yahoo, but the underlying data is unencrypted SS.

UDP Considerations with SS

It’s crucial to note that UDP traffic through SS does not undergo the same underlying transport security (like Reality) as TCP traffic. To encrypt UDP data, the SS protocol itself must be configured with encryption.

Stripping TLS from Trojan: A Deep Dive

Normally, Trojan protocol connections are always TLS encrypted. However, by directly manipulating the core configuration, TLS can be removed. The demonstration captures unencrypted Trojan data packets and analyses their structure.

The captured data includes:

• SHA224 hash of the password.
• Indicators for TCP connection establishment and IPv4 address.
• The actual transmitted data without encryption.

Trojan also supports UDP data transfer via TCP, encapsulating UDP packets within TCP connections.

Implementing AnyReality with Sing-box

AnyReality, which combines AnyTLS with Reality, offers a solution to TLS-in-TLS issues without requiring manual certificate configuration. The article provides a step-by-step guide to setting up AnyReality using Sing-box.

Server-Side Configuration:

1. Install Sing-box on a VPS using the provided commands.
2. Edit the Sing-box configuration file, applying the AnyReality settings.
3. Restart the Sing-box service.

Client-Side Configuration:

1. Use Sing-box SFM (macOS) or SFA (Android) on the client device.
2. Add and configure an AnyReality profile within the Sing-box application.
3. Enable the AnyReality profile to initiate the connection.

By implementing AnyReality, users can achieve personalized byte padding with AnyTLS, enhancing security and circumventing detection.