Free internet

Fiona Dabare

Well-known member
  • Jul 28, 2024
    8,110
    7,588
    113
    Colombo
    well, it actually happens here
    imagine you are using a mobile internet package that allows unlimited facebook, so you can create a payload that tricks the ISP into thinking your http/https requests are going to Facebook
    It is illegal so I won't elaborate more :yes:
     
    • Like
    Reactions: dgboy

    Fiona Dabare

    Well-known member
  • Jul 28, 2024
    8,110
    7,588
    113
    Colombo
    I hv heard people call thease config files "ehi" but since I hv not used thease in real life idk what it is called.
    but the mechanism behind this is very simple.
    we use HTTP and HTTPS protocols to interact with web resources. A HTTP request has a HTTP method, data, and headers. headers indicate specific attributes of the request. "Host" is a common HTTP header that is used to indicate which back end component client wants to communicate with.

    when we use HTTP protocol, we can modify this "Host" header field to be the host name of the zero rating domain so the ISP will consider this traffic as zero rating traffic. when the HTTP response comes back we can setup a middleware server between the ISP and the server to change the "Host" header so the isp will consider it as zero rating traffic.

    when it comes to HTTPS, the traffic between the user and the server is encrypted. so the "Host" header field is also encrypted and the ISP cannot directly inspect the content of the request. But ISP can inspect the TLS client hello message which is unencrypted and determine the destination server. so we can modify SNI field in TLS/SSL connection to be the host name of the zero rating domain and also we can decrypt and modify the traffic setting up a middleware server since we have the priv key and the session key of the TLS connection.
    (use this for Educational purposes)
     

    Hyaenidae

    Well-known member
  • Apr 8, 2015
    52,303
    2
    53,754
    113
    but the mechanism behind this is very simple.
    we use HTTP and HTTPS protocols to interact with web resources. A HTTP request has a HTTP method, data, and headers. headers indicate specific attributes of the request. "Host" is a common HTTP header that is used to indicate which back end component client wants to communicate with.

    when we use HTTP protocol, we can modify this "Host" header field to be the host name of the zero rating domain so the ISP will consider this traffic as zero rating traffic. when the HTTP response comes back we can setup a middleware server between the ISP and the server to change the "Host" header so the isp will consider it as zero rating traffic.

    when it comes to HTTPS, the traffic between the user and the server is encrypted. so the "Host" header field is also encrypted and the ISP cannot directly inspect the content of the request. But ISP can inspect the TLS client hello message which is unencrypted and determine the destination server. so we can modify SNI field in TLS/SSL connection to be the host name of the zero rating domain and also we can decrypt and modify the traffic setting up a middleware server since we have the priv key and the session key of the TLS connection.
    (use this for Educational purposes)

    Harvey Specter GIF by Suits
     
    • Haha
    Reactions: Fiona Dabare

    gihand4r

    Well-known member
  • Oct 29, 2007
    13,537
    3,955
    113
    Lanka
    ehi tama. ita amathara ewath tiyenawa. owa ithin hamotama kiyala kela karagnna ba ne.

    ehi walin karaganin