curl / browser / Playwright
        │  HTTP CONNECT (to proxy)
        ▼
┌─────────────────────────────────────────┐
│            impersonate-proxy            │
│                                         │
│  MITM TLS ◄──────────────► uTLS         │
│  (our CA cert)          (custom JA3/4)  │
│                                         │
│  Header rewriter (UA, order, add/del)   │
│  HTTP/2 framer  (SETTINGS, WINDOW_UPDATE│
│                  pseudo-header order)   │
└─────────────────────────────────────────┘
        │  Custom TLS ClientHello + HTTP/2
        ▼
   Target server / WAF

brew install go

# 下载并解压(请将 1.22.5 替换为 https://go.dev/dl/ 上的最新版本)
curl -OL https://go.dev/dl/go1.22.5.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.22.5.linux-amd64.tar.gz

# 添加到 PATH(如需永久生效,请将此行添加到 ~/.bashrc 或 ~/.zshrc)
export PATH=$PATH:/usr/local/go/bin

go version
# go version go1.22.5 linux/amd64

git clone https://github.com/ytkoka/impersonate-proxy.git
cd impersonate-proxy
make build

make run
# 2026/04/22 12:00:00 generated CA certificate → ca.crt
# 2026/04/22 12:00:00 listening on 127.0.0.1:8080  preset=chrome

make trust-ca        # runs: sudo security add-trusted-cert ...

# Debian / Ubuntu
sudo cp ca.crt /usr/local/share/ca-certificates/impersonate-proxy.crt
sudo update-ca-certificates

# RHEL / Fedora / Amazon Linux
sudo cp ca.crt /etc/pki/ca-trust/source/anchors/impersonate-proxy.crt
sudo update-ca-trust

curl --cacert ca.crt ...

export NODE_EXTRA_CA_CERTS="$(pwd)/ca.crt"

git clone https://github.com/ytkoka/impersonate-proxy.git
cd impersonate-proxy
docker compose up -d

impersonate-proxy  | generated CA certificate → /data/ca.crt (add to OS trust store to avoid cert errors)
impersonate-proxy  | listening on 0.0.0.0:8080  preset=chrome

docker run -d --name impersonate-proxy \
  -p 127.0.0.1:8080:8080 -p 127.0.0.1:8081:8081 \
  -v "$(pwd)/config.docker.yaml:/config.yaml:ro" \
  -v "$(pwd)/data:/data" \
  ghcr.io/ytkoka/impersonate-proxy:latest

# curl
curl --proxy http://127.0.0.1:8080 --cacert ./data/ca.crt https://tls.peet.ws/api/all

# macOS 系统钥匙串
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./data/ca.crt

docker compose restart

docker compose down          # 停止容器
rm -rf data                  # 同时删除持久化的 CA(删除后需要重新信任)

listen: "127.0.0.1:8080"
mgmt_listen: "127.0.0.1:8081"  # Chrome 扩展使用的管理 API(留空可禁用)
ca_cert: "ca.crt"
ca_key:  "ca.key"

tls:
  # TLS 指纹预设(控制 JA3 / JA4)
  # 可选值: chrome | firefox | safari | edge | ios | random | golang
  preset: "chrome"

http:
  # 覆盖 User-Agent(留空则原样转发客户端的 UA)
  user_agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

  # 伪装源 IP:将 X-Forwarded-For 和 True-Client-IP 都设置为该值,
  # 覆盖客户端可能已设置的值(留空则禁用)
  # client_ip: "1.2.3.4"

  # 按此顺序发送请求头;未列出的请求头会附加在末尾
  header_order:
    - "Host"
    - "User-Agent"
    - "Accept"
    - "Accept-Language"
    - "Accept-Encoding"
    - "Connection"

  # 添加或覆盖请求头
  add_headers:
    Accept-Language: "ja,en-US;q=0.9,en;q=0.8"

  # 转发前移除的请求头
  remove_headers: []

http2:
  enabled: true

  # SETTINGS 帧条目 — id 和顺序都会影响 HTTP/2 指纹。
  # RFC 7540 §11.3 的 ID:
  #   1=HEADER_TABLE_SIZE  2=ENABLE_PUSH  3=MAX_CONCURRENT_STREAMS
  #   4=INITIAL_WINDOW_SIZE  5=MAX_FRAME_SIZE  6=MAX_HEADER_LIST_SIZE
  settings:
    - { id: 1, val: 65536 }    # 此处展示的是 Chrome 的默认值
    - { id: 2, val: 0 }
    - { id: 4, val: 6291456 }
    - { id: 6, val: 262144 }

  # 连接级别的 WINDOW_UPDATE 增量
  window_update: 15663105

  # HEADERS 帧中伪首部的顺序
  pseudo_header_order: [method, authority, scheme, path]

# 读取当前设置
curl http://127.0.0.1:8081/api/config

# 切换为 Firefox 指纹并设置伪装 IP(其他字段不受影响)
curl -s -X POST http://127.0.0.1:8081/api/config \
  -H "Content-Type: application/json" \
  -d '{"tls_preset":"firefox","client_ip":"203.0.113.1"}'

# 在运行时切换为任意 JA3/JA4 指纹 — 字段与 config.yaml 中的
# custom_hello 块相同,以 JSON 形式发送(参见下方的“自定义 TLS 指纹”)
curl -s -X POST http://127.0.0.1:8081/api/config \
  -H "Content-Type: application/json" \
  -d '{
    "tls_preset": "custom",
    "custom_hello": {
      "cipher_suites": [2570, 4865, 4866, 4867, 49195, 49199, 49196, 49200, 52393, 52392, 49171, 49172, 156, 157, 47, 53],
      "curves": ["X25519", "P256", "P384"],
      "versions": ["1.3", "1.2"],
      "extensions": [2570, 0, 23, 65281, 10, 11, 35, 16, 5, 18, 13, 51, 45, 43, 27, 21]
    },
    "client_ip": "",
    "user_agent": ""
  }'

# 启用上游代理并按名称选择 — TLS 预设、源 IP、User-Agent 保持不变
curl -s -X POST http://127.0.0.1:8081/api/config \
  -H "Content-Type: application/json" \
  -d '{"upstream_enabled": true, "upstream_select": "residential_us"}'

# 读取当前上游代理状态
curl -s http://127.0.0.1:8081/api/upstream

tls:
  preset: "custom"
  custom_hello:
    cipher_suites:      # 十六进制 ID;0x0a0a = GREASE 占位符(每次连接随机化)
      - 0x0a0a
      - 0x1301          # TLS_AES_128_GCM_SHA256
      - 0x1302          # TLS_AES_256_GCM_SHA384
      - 0x1303          # TLS_CHACHA20_POLY1305_SHA256
      - 0xc02b          # ECDHE-ECDSA-AES128-GCM-SHA256
      - 0xc02f          # ECDHE-RSA-AES128-GCM-SHA256
      - 0xc02c          # ECDHE-ECDSA-AES256-GCM-SHA384
      - 0xc030          # ECDHE-RSA-AES256-GCM-SHA384
      - 0xcca9          # ECDHE-ECDSA-CHACHA20-POLY1305
      - 0xcca8          # ECDHE-RSA-CHACHA20-POLY1305
      - 0xc013          # ECDHE-RSA-AES128-SHA
      - 0xc014          # ECDHE-RSA-AES256-SHA
      - 0x009c          # RSA-AES128-GCM-SHA256
      - 0x009d          # RSA-AES256-GCM-SHA384
      - 0x002f          # RSA-AES128-SHA
      - 0x0035          # RSA-AES256-SHA
    curves:             # X25519 | X25519Kyber768 | P256 | P384 | P521
      - "X25519Kyber768"
      - "X25519"
      - "P256"
    versions:           # 要通告的 TLS 版本
      - "1.3"
      - "1.2"
    extensions:         # 按顺序排列的扩展类型 ID(控制 JA3 的 extensions 部分)
      - 0x0a0a          # GREASE
      - 0               # server_name (SNI)
      - 23              # extended_master_secret
      - 65281           # renegotiation_info
      - 10              # supported_groups
      - 11              # ec_point_formats
      - 35              # session_ticket
      - 16              # ALPN
      - 5               # status_request
      - 18              # signed_certificate_timestamp
      - 13              # signature_algorithms
      - 51              # key_share
      - 45              # psk_key_exchange_modes
      - 43              # supported_versions
      - 27              # compress_certificate
      - 17513           # application_settings (ALPS)
      - 0x0a0a          # GREASE
      - 21              # padding

upstream:
  enabled: false                         # 默认关闭;可在运行时切换,无需重启
  select: "residential_us"               # 代理名称 | "rotate" | "random" | ""(第一个代理)
  dial_timeout_ms: 15000
  suppress_ip_headers_when_active: true  # 上游代理生效时不发送 XFF/True-Client-IP——避免"干净的 IP 却声称伪造的 IP"这种矛盾
  proxies:
    - name: residential_us
      url: "socks5://user:[email protected]:1080"   # 主机名由代理端解析(即 SOCKS5h 行为),本地绝不解析
    - name: datacenter
      url: "http://user:[email protected]:8080"
    - name: tor
      url: "socks5://127.0.0.1:9050"                   # 可免费试用: brew install tor && brew services start tor

curl -s -X POST http://127.0.0.1:8081/api/config \
  -H "Content-Type: application/json" \
  -d '{"upstream_enabled": true, "upstream_select": "residential_us"}'

make run
# 结束占用 8080 端口的旧进程,重新构建并启动。

# 在系统已信任 CA 的情况下(执行 make trust-ca 之后):
curl --proxy http://127.0.0.1:8080 https://tls.peet.ws/api/all

# 未在系统中信任 CA — 显式指定 CA:
curl --proxy http://127.0.0.1:8080 --cacert ca.crt https://tls.peet.ws/api/all

const { chromium } = require('playwright');

const browser = await chromium.launch();
const context = await browser.newContext({
  proxy: { server: 'http://127.0.0.1:8080' },
});
// 如果 CA 未加入系统信任,启动前设置:
// NODE_EXTRA_CA_CERTS=./ca.crt node script.js
const page = await context.newPage();
await page.goto('https://tls.peet.ws/api/all');

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch()
    context = browser.new_context(proxy={"server": "http://127.0.0.1:8080"})
    page = context.new_page()
    page.goto("https://tls.peet.ws/api/all")

curl -s --proxy http://127.0.0.1:8080 --cacert ca.crt \
  https://tls.peet.ws/api/all | python3 -m json.tool

impersonate-proxy/
├── main.go                   # 入口文件
├── config/config.go          # YAML 配置结构体与默认值
├── fp/dialer.go              # uTLS dialer — TLS 指纹预设
├── h2fp/conn.go              # HTTP/2 帧处理器 — SETTINGS / WINDOW_UPDATE / 伪首部控制
├── mitm/ca.go                # MITM CA:生成、缓存并颁发叶子证书
├── upstream/                 # 上游 SOCKS5/HTTP-CONNECT 代理:管理器、dialer、选择逻辑
├── proxy/proxy.go            # 代理服务器:CONNECT 处理、协议分支、运行时配置
├── rewrite/headers.go        # HTTP 请求头改写(UA、顺序、增删、IP 伪装)
├── mgmt/server.go            # 管理 HTTP API(/api/config, /api/upstream)
├── chrome-extension/
│   ├── manifest.json         # Manifest V3
│   ├── popup.html            # 工具栏弹出窗口 UI
│   ├── popup.css
│   ├── popup.js               # 代理开关 + 上游代理开关 + 管理 API 客户端
│   ├── icon.svg
│   └── icon16.png, icon48.png, icon128.png  # 工具栏 / Web Store 图标
├── config.yaml               # 默认配置
├── config.docker.yaml        # docker-compose.yml 使用的配置
├── examples/
│   └── waf-fingerprint-test.js  # Playwright 测试脚本:轮流切换预设并记录 WAF 判定结果
├── Dockerfile
├── docker-compose.yml
└── Makefile

make clean

sudo security delete-certificate -c "impersonate-proxy CA" /Library/Keychains/System.keychain