i’m sorry the A/AAAA yizx.net RRs are still pointing to the wrong server :c i promise i’ll fix it…. (also ignore the part where i stupidly ran s_client without -nocommands, the C in Connection: closed instantly reconnects the whole thing so uh… please ignore it was embarrassing ok i have tons of homework i can’t re-record this please just- please skip that part :[)
in the mean time here’s how you can visit either one of them using this technique they call domain fronting (i didn’t know it had a name; i just knew the name “outside” had to somehow please the GFW, didn’t know this SNI really is in cleartext… :o)
and it should go without saying but you cannot use cleartext HTTP for this; the moment they see your Host header the same way my server it sees it is OVER (unless you tire out their TCP packet inspectors by manually typing said request (which takes like .1 seconds, but you aren’t realistically gonna be typing out the whole request, are you? :c))
also to windows folks using s_client omit -crlf; your terminal already sends it doing so is counterproductive and will fail!!!
credits to https://superuser.com/a/197043/2641288 for suggesting the use of wget --spider (i don’t use wget usually, that’s why i needed to look it up…) ! also this is a screencast for status.rapidcow.org :)
the commands if you like copy-and-pastable versions better (not that asciinema isn’t copy-and-pastable, well):
$ openssl s_client -quiet -nocommands -crlf -servername rapidcow.org -connect www.yizx.net:443
HEAD / HTTP/1.1
Host: www.yizx.net
User-agent: (you can say hi here if you want! it's the only thing i see in my logs :)
Connection: close
$ curl -H 'Host: www.yizx.net' -I https://rapidcow.org/
$ wget -S --spider --header 'Host: www.yizx.net' https://rapidcow.org/
(remove -I or --spider for regular GET request; if i mess up A/AAAA records, resolve the name rapidcow.org yourself by (i only know how to do this with curl) adding --resolve, e.g. --resolve rapidcow.org:443:<IP>, the IP which you get from dig A +short www.yizx.net. oh and the -O - wasn’t actually necessary with -S in wget.)
