TLS-Attacker's Workflow Traces and Modifiable Variables mechanisms allow testers to specify arbitrary protocol flows and apply field-level modifications — including adding, removing, or overwriting individual TLS message fields — without breaking the internal TLS state machine. This makes it the standard instrument for probing how DPI systems and active-probing detectors respond to non-standard or mutated TLS handshakes.
From 2024-niere-tls-attacker — TLS-Attacker: A Dynamic Framework for Analyzing TLS Implementations
· §1 Introduction
· 2024
· ACSAC 2024 (2nd Place Impact Award)
Implications
Use TLS-Attacker to fuzz each field of the ClientHello (cipher-suite ordering, extensions, GREASE values) against a censor-controlled endpoint to map which deviations from a 'normal' fingerprint trigger blocking.
Script TLS-Attacker to simulate active-probing probe sequences (e.g., unexpected HelloRequest, out-of-order Finished) to verify that a circumvention server correctly handles or rejects the probe without leaking its proxy nature.