Pentesting Vodafone: ISP Bypass Scanner (Python Edition)

An advanced pentesting and network analysis application designed to simulate real-world techniques used to bypass ISP bandwidth throttling. This application uses SNI/Host-based tunneling techniques and implements TLS fragmentation to validate quota enforcement mechanisms ethically.

Ethical Boundary: This tool is strictly for authorized penetration testing and internal security auditing. Exploring public infrastructure without authorization will trigger guard rails unless explicitly permitted.

Project Architecture

• main.py: The central Typer CLI application for kicking off orchestrated scanning workflows and dashboards.
• scanner/: Asynchronous concurrent mass-scanning workers (engine.py) and connection validation modules (throughput.py).
• evasion/: Specialized libraries for fooling basic Deep Packet Inspection (DPI) heuristics using protocol side-channels (e.g. SNI mismatching, domain fronting) and TLS ClientHello fragmentation (dlpi.py, tls_engine.py).
• core/: Critical runtime components governing stealth, proxies, target scoping, and analytical reporting.
• ml/: Behavioral logic for finding anomalies and verifying false-positives across scanner outputs.
• db/: Asynchronous storage engines for historical persistence.
• dashboard/: Operational visualization and metrics UI.

Requirements & Setup

This implementation relies on Python 3.10+. All async operations are natively supported by the standard libraries alongside advanced evasion libraries.

pip install -r requirements.txt

Example CLI Usage

Run a mass scan with all evasion techniques on the targets.json dataset. Concurrency is limited here to 50 for responsible pacing. A scope ticket is mandatory.

python main.py scan targets.json \
    --technique all \
    --concurrency 50 \
    --stealth \
    --authorized-scope TICKET-7734 \
    --output reports/scan_results.json

Starting the Dashboard Environment Provides runtime metrics and controls over active jobs:

python main.py dashboard --address localhost:8080 --history history.jsonl

Sample Scan Workflow

A standard diagnostic campaign relies on the following steps:

1. Target Identification: Construct a basic initial list of suspected host domains and port pairs (usually port 443).
2. Profiling Execution: Run a scan command using --stealth. The scanner's StealthProfileManager dynamically distributes IP fragments and varies latency jitters per-worker to prevent IP blacklisting.
3. Throttled Baseline Check: The async workers perform a TLS handshake locally via an explicit white-listed SNI (e.g., speedtest.net) and record the baseline kilobits/second rate over standard quota lines.
4. Injection and Re-Testing: The workers inject varying permutations of arbitrary payload architectures based on configured evasion modules (Domain Fronting/SMUGGLING) and measure comparative bytes-per-second throughput via the candidate path.
5. Rating & Persistence: Significant differentials triggers the ML Verification engine. The results are scored dynamically and written permanently to scan_results.db. The application simultaneously yields formatted intel.json outputs for external ingestion.

Optimization Suggestions for Scaling

If scaling this system to assess significantly larger datasets (e.g., scanning multiple large Cloudflare/AWS CIDR blocks globally), the following architectural enhancements should be applied to the current concurrency model:

1. Message Broker Integration: Migrate the priority_queue list in scanner/engine.py to a distributed task routing mesh (like RabbitMQ or Redis Streams) allowing multi-server horizontal scaling rather than solitary process scaling.
2. eBPF/C-based TLS Splicing: Replace pure-Python socket fragmentation with an underlying eBPF filtering setup or offload raw packet crafting securely to a Rust/Go daemon for exponentially higher throughputs beyond Python's Global Interpreter Lock (GIL).
3. Bandwidth Stratification: Performing 5-second throughput estimates against 100,000 servers inherently risks overwhelming local uplink capacity. Implement an upstream orchestrator that limits the maximum concurrent active throughput sessions independently from active TLS handshake sessions.
4. Headless Execution: Run with full log structuring enabled directly into an Elasticsearch/Splunk deployment utilizing containerized deployments across diverse Autonomous Systems (ASNs).