Skip to content

A simple python tool to pinpoint the IP addresses of machines working for the Great Firewall of China.

Notifications You must be signed in to change notification settings

zeroomega/mongol

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

18 Commits
 
 
 
 

Repository files navigation

#mongol

Mongol.py is a tool that was inspired by a research paper[0] that described the physical location and number of routers acting for the Great Firewall (GFW) of China

Mongol is effectively a implementation of the research tool used by Xu etc all, with the intent to demystify some aspects of the GFW. It is built using scapy[1] for some of the TCP header modification requirements

[0] http://pam2011.gatech.edu/papers/pam2011--Xu.pdf

[1] http://www.secdev.org/projects/scapy/

##Usage

python mongol.py -i hostslist.txt -o outputfilename.txt

hostslist.txt --- The input file is a newline seperated list of ip's and domain names of websites hosted within china.

outputfilename.txt --- The output file will be location where ip addresses of found filtering devices will be printed.

##How it works

Mongol MUST be run on a device that is Internet facing, aka NOT behind a router or firewall.

Mongol works by stimulating the keyword filtering that the GFW uses. First we create a test connection and check that the site is indeed hosting a webserver and is live. Then by sending the stimulus 'tibetalk' the keyword filtering will become active. Finally we run a TCP header traceroute and find the last hop before RST packets are sent back. RST packets are the GFW's method of stopping connections with filtered keywords.

About

A simple python tool to pinpoint the IP addresses of machines working for the Great Firewall of China.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published