GitHub - boratanrikulu/gecit: DPI bypass tool — eBPF on Linux, proxy on macOS.
Uses BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB to detect new TLS connections, then injects a fake ClientHello with spoofed SNI and low TTL via raw socket before the real handshake. Includes MSS clamping f...
Source: GitHub
Uses BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB to detect new TLS connections, then injects a fake ClientHello with spoofed SNI and low TTL via raw socket before the real handshake. Includes MSS clamping for ClientHello fragmentation and a built-in DoH resolver. Comments
