Systems for censoring content on the internet are becoming increasingly more sophisticated. These systems are used to restrict access to certain parts of the web and can, therefore, limit users’ freedom of information in censored regions. Since a relevant portion of internet traffic is still sent over unencrypted HTTP, censorship systems can easily inspect the content and selectively block requests. To aid affected people in accessing content accessible only over HTTP, recent studies have explored techniques for censorship evasion that manipulate HTTP data. While many different approaches have been proposed in the literature, there is a lack of practical tools that implement and combine different
evasion techniques, enabling users to easily apply them in practice.
Our work builds on prior research by implementing 70 direct HTTP manipulation strategies and 27 HTTP request smuggling strategies into an existing proxy, and evaluating their performance against a real-world censorship system in China and popular web server versions. We find 8 direct manipulations and 1 smuggling strategy to evade censorship in China while remaining compatible with modern, widely used web servers. However, some of these succeed only for specific URLs or server configurations.
Overall, our findings highlight the ongoing arms race between censorship systems and evasion techniques, and the need for continued research in this area to ensure unrestricted access to information on the internet.